Read the docs
TI-2020-04460 Aliases CVE-2020-5414GHSA-6p3r-vmr8-vfcg

App Autoscaler logs credentials

Priority LOW 27CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are available to authenticated users of the BOSH Director. This credential would grant administrative privileges to a malicious user. The same versions of App Autoscaler also log the App Autoscaler Broker password. Prior to newer versions of Operations Manager, this credential was not redacted from logs. This credential allows a malicious user to create, delete, and modify App Autoscaler services instances. Operations Manager started redacting this credential from logs as of its versions 2.7.15, 2.8.6, and 2.9.1. Note that these logs are typically only visible to foundation administrators and operators.

Why it matters now

EPSS 0.00707 53rd percentileScored 2026-11-07
Fix Fixed PCF Autoscaling (VMware Tanzu): v232Operations Manager (VMware Tanzu): 2.7.15, 2.8.6, 2.9.1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwarePCF AutoscalingAll to before v232v232Patch availableCNA
VMwareOperations Manager2.7 to before 2.7.15; 2.8 to before 2.8.6; 2.9 to before 2.9.12.7.15, 2.8.6, 2.9.1Patch availableCNA
VMwareVMware Tanzu Application Service for VMs2.9.x to before 2.9.7; 2.7.x to before 2.7.19; 2.8.x to before 2.8.132.9.7, 2.7.19, 2.8.13Patch availableCNA
  • PCF Autoscaling VendorVMware Affected All to before v232 Fixed in v232 Patch available CNA
  • Operations Manager VendorVMware Affected 2.7 to before 2.7.15; 2.8 to before 2.8.6; 2.9 to before 2.9.1 Fixed in 2.7.15, 2.8.6, 2.9.1 Patch available CNA
  • VMware Tanzu Application Service for VMs VendorVMware Affected 2.9.x to before 2.9.7; 2.7.x to before 2.7.19; 2.8.x to before 2.8.13 Fixed in 2.9.7, 2.7.19, 2.8.13 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vmware:tanzu_application_service_for_virtual_machines:*:*:*:*:*:*:*:*2.7.0 to before 2.7.19; 2.8.0 to before 2.8.13; 2.9.0 to before 2.9.7VulnerableVMware
cpe:2.3:a:vmware:operations_manager:*:*:*:*:*:*:*:*2.7.0 to before 2.7.15; 2.8.0 to before 2.8.6; 2.9.0 to before 2.9.1VulnerableVMware
  • cpe:2.3:a:vmware:tanzu_application_service_for_virtual_machines:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.19; 2.8.0 to before 2.8.13; 2.9.0 to before 2.9.7 Vulnerable ·VMware
  • cpe:2.3:a:vmware:operations_manager:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.15; 2.8.0 to before 2.8.6; 2.9.0 to before 2.9.1 Vulnerable ·VMware

Remediation

  • Fix · CNA PCF Autoscaling (VMware Tanzu) Fixed in v232
  • Fix · CNA Operations Manager (VMware Tanzu) Fixed in 2.7.15, 2.8.6, 2.9.1
  • Fix · CNA VMware Tanzu Application Service for VMs (VMware Tanzu) Fixed in 2.9.7, 2.7.19, 2.8.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5414
  2. 2026-10-03 Alias added: GHSA-6p3r-vmr8-vfcg

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences