CVE-2020-5406

6.5 mediumEPSS 1.0%

Medium (6.5) in vmware tanzu application service for vms. EPSS 1.0% chance of exploitation in the next 30 days.

VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2020-04-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vmware:tanzu_application_service_for_vms

References

https://tanzu.vmware.com/security/cve-2020-5406
https://tanzu.vmware.com/security/cve-2020-5406

Check your stack JSON