CVE-2020-5414: vmware tanzu operations manager
Vulnerability summary
CVE-2020-5414 is a medium (CVSS 6.0) vulnerability in vmware tanzu operations manager. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.6% of scored vulnerabilities.
Timeline
- 31-07-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are available to authenticated users of the BOSH Director. This credential would grant administrative privileges to a malicious user. The same versions of App Autoscaler also log the App Autoscaler Broker password. Prior to newer versions of Operations Manager, this credential was not redacted from logs. This credential allows a malicious user to create, delete, and modify App Autoscaler services instances. Operations Manager started redacting this credential from logs as of its versions 2.7.15, 2.8.6, and 2.9.1. Note that these logs are typically only visible to foundation administrators and operators.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST5.7MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:H
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
0.00 pp
From 0.71% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Vmware tanzu3 products
- operations manager≥ 2.7, < 2.7.15 | ≥ 2.8, < 2.8.6 | ≥ 2.9, < 2.9.1
- pcf autoscaling≥ All, < v232
- vmware tanzu application service for vms≥ 2.9.x, < 2.9.7 | ≥ 2.7.x, < 2.7.19 | ≥ 2.8.x, < 2.8.13
Vmware2 products
- operations_manager≥ 2.7.0, < 2.7.15 | ≥ 2.8.0, < 2.8.6 | ≥ 2.9.0, < 2.9.1
- tanzu_application_service_for_virtual_machines≥ 2.7.0, < 2.7.19 | ≥ 2.8.0, < 2.8.13 | ≥ 2.9.0, < 2.9.7
2 vendors · 5 products