CVE-2020-5418 — Cloud Controller allows users with no roles to list droplets

CVE-2020-5418

Cloud Controller allows users with no roles to list droplets PUBLISHED

Description (CNA)

Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).

Affected (CNA)

Vendor / product	Versions
Cloud Foundry / CAPI	affected All before 1.98.0
Cloud Foundry / CF Deployment	affected All before 13.17.0

CWE

CWE-863

References

https://www.cloudfoundry.org/blog/cve-2020-5418

ADP enrichment

CVE

No English description supplied.

https://www.cloudfoundry.org/blog/cve-2020-5418