CVE-2020-5406: PCF Autoscaling logs its database credentials

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-10 · updated 2026-06-17
Weakness: CWE-522

Description

VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling.

Affected products

Pivotal VMware Tanzu Application Service for VMs: from 2.6.0 before 2.6.18; from 2.7.0 before 2.7.11; from 2.8.0 before 2.8.5 — fixed in 2.6.18, 2.7.11, 2.8.5
Pivotal VMware Tanzu Application Service for VMs: from 2.8.x before 2.8.5; from 2.7.x before 2.7.11; from 2.6.x before 2.6.18 — fixed in 2.8.5, 2.7.11, 2.6.18

How to fix

Upgrade to a fixed version: Pivotal VMware Tanzu Application Service for VMs 2.6.18, 2.7.11, 2.8.5; Pivotal VMware Tanzu Application Service for VMs 2.8.5, 2.7.11, 2.6.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-5406 or the next vulnerability affects your stack