CVE-2020-5417

8.8 highEPSS 1.0%

High (8.8) in cloudfoundry. EPSS 1.0% chance of exploitation in the next 30 days.

Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally claiming certain sensitive routes, potentially resulting in the developer's app handling some requests that were expected to go to certain system components.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2020-08-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cloudfoundry:capi-release
cloudfoundry:cf-deployment

References

https://www.cloudfoundry.org/blog/cve-2020-5417
https://www.cloudfoundry.org/blog/cve-2020-5417

Check your stack JSON