CVE-2020-5423

HIGH

CAPI < 1.101.0 - Unauthenticated Denial of Service via YAML Parser

Title source: llm
STIX 2.1

Description

CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.cloudfoundry.org/blog/cve-2020-5423

Scores

CVSS v3 7.5
EPSS 0.0113
EPSS Percentile 62.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-400
Status published
Products (2)
cloudfoundry/capi-release < 1.101.0
cloudfoundry/cf-deployment < 15.0.0
Published Dec 02, 2020
Tracked Since Feb 18, 2026