Advisories · Technology

Cloud Foundry CAPI.

Every CVE that names Cloud Foundry CAPI among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2020-5423 CVE record

CVSS 7.5 High

Cloud Controller is vulnerable to denial of service via YAML parsing
- Cloud Foundry CAPI
- Cloud Foundry CF Deployment
- Denial of service
Not analysed yet 2 Dec 2020
CVE-2020-5418 CVE record

CVSS 3.1 Low

Cloud Controller allows users with no roles to list droplets
- Cloud Foundry CAPI
- Cloud Foundry CF Deployment
- Broken access control
Not analysed yet 3 Sept 2020
CVE-2020-5417 CVE record

CVSS 8.5 High

Cloud Controller may allow developers to claim sensitive routes
- Cloud Foundry CAPI
- Cloud Foundry CF Deployment
- Broken access control
Not analysed yet 21 Aug 2020
CVE-2020-5400 CVE record

CVSS 8.0 High

Cloud Controller logs environment variables from app manifests
- Cloud Foundry CAPI
- Hard-coded credentials
Not analysed yet 27 Feb 2020
CVE-2019-11294 CVE record

CVSS 4.3 Medium

CAPI leaks service broker URLs and GUIDs to space developers
- Cloud Foundry CAPI
- Information disclosure
Not analysed yet 19 Dec 2019
CVE-2019-3785 CVE record

CVSS 6.5 Medium

Cloud Controller provides signed URL with write authorization to read only user
- Cloud Foundry CAPI
- Broken access control
Not analysed yet 13 Mar 2019