CVE-2020-5418 — Cloud Controller allows users with no roles to list droplets
Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all d…
Published: 2020-09-03 · CVSS: 3.1 · CVSS 3.0
Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all droplets in all spaces (whereas they should see none).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7