CVE-2020-5399

7.4 highEPSS 0.5%

High (7.4). EPSS 0.5% chance of exploitation in the next 30 days.

Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.

Severity

CVSS 3.1

7.4 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWE: CWE-319
Published: 2020-02-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cloudfoundry:credhub
pivotal_software:cloud_foundry_cf-deployment

References

https://www.cloudfoundry.org/blog/cve-2020-5399
https://www.cloudfoundry.org/blog/cve-2020-5399

Check your stack JSON