CVE-2020-5422
Last modified
CVE-2020-5422 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).. EPSS estimates a 0.91% chance of exploitation in the next 30 days.
Description
BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cloud Foundry | Bosh System Metrics Server | < 0.1.0 |
References
- https://www.cloudfoundry.org/blog/cve-2020-5422Vendor Advisory
- https://www.cloudfoundry.org/blog/cve-2020-5422Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-5422?
How severe is CVE-2020-5422?
How do I fix CVE-2020-5422?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-5416Cloud Foundry Routing (Gorouter), versions prior to 0.204.0,…6.5
- CVE-2020-5417Cloud Foundry CAPI (Cloud Controller), versions prior to 1.9…8.8
- CVE-2020-5418Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98…4.3
- CVE-2020-5419RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Window…6.7
- CVE-2020-5420Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 a…7.7
- CVE-2020-5421In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, …6.5
- CVE-2020-5423CAPI (Cloud Controller) versions prior to 1.101.0 are vulner…7.5
- CVE-2020-5424Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-5425Single Sign-On for Vmware Tanzu all versions prior to 1.11.3…7.9
- CVE-2020-5426Scheduler for TAS prior to version 1.4.0 was permitting plai…9.8
- CVE-2020-5427In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, ve…7.2
- CVE-2020-5428In applications using Spring Cloud Task 2.2.4.RELEASE and be…6
Are you affected by CVE-2020-5422?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST