TI-2020-04471 Aliases CVE-2020-5426 GHSA-3cvg-mw7q-93pw

Scheduler for TAS can transmit privileged UAA token in plaintext

MEDIUM 43CWE-319Published 2020-11-11 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.

Summary

Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the service. If intercepted the token can give an attacker admin level access in the cloud controller.

Why it matters now

EPSS 0.00708 53rd percentileScored 2026-11-07

Fix Fixed Pivotal Scheduler (VMware Tanzu): 1.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Pivotal Scheduler	All to before 1.4.0	1.4.0	Patch available	CNA

Pivotal Scheduler VendorVMware Affected All to before 1.4.0 Fixed in 1.4.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:pivotal_scheduler::::::::	before 1.4.0	Vulnerable	VMware

cpe:2.3:a:vmware:pivotal_scheduler:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·VMware

Remediation

Fix · CNA Pivotal Scheduler (VMware Tanzu) Fixed in 1.4.0

Timeline

2026-10-02 Threatist record created from CVE-2020-5426
2026-10-03 Alias added: GHSA-3cvg-mw7q-93pw

References

Advisory 1

https://tanzu.vmware.com/security/cve-2020-5426

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences