CVE-2020-5414

VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are available to authenticated users of the BOSH Director. This credential would grant administrative privileges to a malicious user. The same versions of App Autoscaler also log the App Autoscaler Broker password. Prior to newer versions of Operations Manager, this credential was not redacted from logs. This credential allows a malicious user to create, delete, and modify App Autoscaler services instances. Operations Manager started redacting this credential from logs as of its versions 2.7.15, 2.8.6, and 2.9.1. Note that these logs are typically only visible to foundation administrators and operators.

• CWE-200
• CWE-532

• https://tanzu.vmware.com/security/cve-2020-5414Vendor Advisory
• https://tanzu.vmware.com/security/cve-2020-5414Vendor Advisory

Published

Jul 31, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5408Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior t…6.5
• CVE-2020-5409Pivotal Concourse, most versions prior to 6.0.0, allows redi…6.1
• CVE-2020-5410Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions…7.5
• CVE-2020-5411When configured to enable default typing, Jackson contained …8.1
• CVE-2020-5412Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, version…6.5
• CVE-2020-5413Spring Integration framework provides Kryo Codec implementat…9.8
• CVE-2020-5415Concourse, versions prior to 6.3.1 and 6.4.1, in installatio…10
• CVE-2020-5416Cloud Foundry Routing (Gorouter), versions prior to 0.204.0,…6.5
• CVE-2020-5417Cloud Foundry CAPI (Cloud Controller), versions prior to 1.9…8.8
• CVE-2020-5418Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98…4.3
• CVE-2020-5419RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Window…6.7
• CVE-2020-5420Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 a…7.7