VMware Tanzu Application Service for VMs up to 2.6.17/2.7.10/2.8.4 Log Credentials insufficiently protected credentials

Summaryinfo

A vulnerability, which was classified as problematic, was found in VMware Tanzu Application Service for VMs up to 2.6.17/2.7.10/2.8.4. The impacted element is an unknown function of the component Log Handler. Such manipulation leads to insufficiently protected credentials (Credentials). This vulnerability is referenced as CVE-2020-5406. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in VMware Tanzu Application Service for VMs up to 2.6.17/2.7.10/2.8.4 and classified as problematic. Affected by this issue is some unknown functionality of the component Log Handler. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability (Credentials). Using CWE to declare the problem leads to CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Impacted is confidentiality. CVE summarizes:

VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling.

The weakness was published 04/10/2020 (Website). The advisory is available at tanzu.vmware.com. This vulnerability is handled as CVE-2020-5406 since 01/03/2020. The exploitation is known to be easy. The attack may be launched remotely. A simple authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

Upgrading to version 2.6.18, 2.7.11 or 2.8.5 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• VMware

Name

• Tanzu Application Service for VMs

Version

• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3
• 2.6.4
• 2.6.5
• 2.6.6
• 2.6.7
• 2.6.8
• 2.6.9
• 2.6.10
• 2.6.11
• 2.6.12
• 2.6.13
• 2.6.14
• 2.6.15
• 2.6.16
• 2.6.17
• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5
• 2.7.6
• 2.7.7
• 2.7.8
• 2.7.9
• 2.7.10
• 2.8.0
• 2.8.1
• 2.8.2
• 2.8.3
• 2.8.4

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion