ByteOS Network

Vulnerability Details :

CVE-2020-5426

Assigner Org ID-862b2186-222f-48b9-af87-f1fb7bb26d03

Published At-11 Nov, 2020 | 17:05

Updated At-17 Sep, 2024 | 03:03

Scheduler for TAS can transmit privileged UAA token in plaintext

Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the service. If intercepted the token can give an attacker admin level access in the cloud controller.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:pivotal

Assigner Org ID:862b2186-222f-48b9-af87-f1fb7bb26d03

Published At:11 Nov, 2020 | 17:05

Updated At:17 Sep, 2024 | 03:03

▼CVE Numbering Authority (CNA)

Scheduler for TAS can transmit privileged UAA token in plaintext

Affected Products

Vendor

VMware (Broadcom Inc.)

Product

Pivotal Scheduler

Versions

Affected

From All before 1.4.0 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-319	CWE-319: Cleartext Transmission of Sensitive Information

Type: CWE

CWE ID: CWE-319

Description: CWE-319: Cleartext Transmission of Sensitive Information

Metrics

Version	Base score	Base severity	Vector
3.0	8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Version: 3.0

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References

Hyperlink	Resource
https://tanzu.vmware.com/security/cve-2020-5426	x_refsource_CONFIRM

Hyperlink: https://tanzu.vmware.com/security/cve-2020-5426

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://tanzu.vmware.com/security/cve-2020-5426	x_refsource_CONFIRM x_transferred

Hyperlink: https://tanzu.vmware.com/security/cve-2020-5426

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@pivotal.io

Published At:11 Nov, 2020 | 17:15

Updated At:01 Dec, 2020 | 19:51

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.0	8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.0

Base score: 8.6

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:N/A:N

CPE Matches

VMware (Broadcom Inc.)

>>pivotal_scheduler>>Versions before 1.4.0(exclusive)

cpe:2.3:a:vmware:pivotal_scheduler:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-319	Primary	nvd@nist.gov
CWE-319	Secondary	security@pivotal.io

CWE ID: CWE-319

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-319

Type: Secondary

Source: security@pivotal.io

References

Hyperlink	Source	Resource
https://tanzu.vmware.com/security/cve-2020-5426	security@pivotal.io	Third Party Advisory

Hyperlink: https://tanzu.vmware.com/security/cve-2020-5426

Source: security@pivotal.io

Resource:

Third Party Advisory

Similar CVEs

206Records found

CVE-2022-33321

Matching Score-4

Assigner-Mitsubishi Electric Corporation

View Details

Matching Score-4

Assigner-Mitsubishi Electric Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.58% / 67.92%

7 Day CHG~0.00%

Published-08 Nov, 2022 | 00:00

Updated-01 May, 2025 | 19:15

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products (PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric HEMS Energy Measurement Unit, Refrigerator, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch, Ventilating Fan, Range hood fan, Energy Measurement Unit and Air Purifier) allows a remote unauthenticated attacker to disclose information in the products or cause a denial of service (DoS) condition as a result by sniffing credential information (username and password). The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.

Vendor-Mitsubishi Electric Corporation

CWE ID-CWE-319

Cleartext Transmission of Sensitive Information

CVE-2021-20154

Matching Score-4

Assigner-Tenable Network Security, Inc.

View Details

Matching Score-4

Assigner-Tenable Network Security, Inc.

CVSS Score-7.5||HIGH

EPSS-0.16% / 36.90%

7 Day CHG~0.00%

Published-30 Dec, 2021 | 21:31

Updated-03 Aug, 2024 | 17:30

Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in cleartext transmission of sensitive information such as passwords.

Vendor-n/a TRENDnet, Inc.

Product-tew-827dru_firmware tew-827dru Trendnet AC2600 TEW-827DRU

CWE ID-CWE-319

Cleartext Transmission of Sensitive Information

CVE-2020-9550

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.24% / 47.36%

7 Day CHG~0.00%

Published-04 Mar, 2020 | 18:19

Updated-04 Aug, 2024 | 10:34

Rubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and beacons, allowing an attacker to sniff and spoof beacon requests remotely.

Vendor-rubetek n/a

Product-smarthome smarthome_firmware n/a

CWE ID-CWE-319

Cleartext Transmission of Sensitive Information

CVE-2020-5893

Matching Score-4

Assigner-F5, Inc.

View Details

Matching Score-4

Assigner-F5, Inc.

CVSS Score-3.7||LOW

EPSS-0.13% / 32.88%

7 Day CHG~0.00%

Published-30 Apr, 2020 | 21:00

Updated-04 Aug, 2024 | 08:47

In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection.

Vendor-n/a F5, Inc.

Product-big-ip_access_policy_manager big-ip_access_policy_manager_client BIG-IP Edge Client

CWE ID-CWE-319

Cleartext Transmission of Sensitive Information

CVE-2020-6198

Matching Score-4

Assigner-SAP SE

View Details

Matching Score-4

Assigner-SAP SE

CVSS Score-9.8||CRITICAL

EPSS-0.27% / 49.72%

7 Day CHG~0.00%

Published-10 Mar, 2020 | 20:18

Updated-04 Aug, 2024 | 08:55

SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remote functions on the Agent due to Missing Authentication Check.

Vendor-SAP SE

Product-solution_manager SAP Solution Manager (Diagnostics Agent)

CWE ID-CWE-319

Cleartext Transmission of Sensitive Information

CWE ID-CWE-306

Missing Authentication for Critical Function

CVE-2022-47714

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.05% / 13.39%

7 Day CHG~0.00%

Published-01 Feb, 2023 | 00:00

Updated-27 Mar, 2025 | 15:15

Last Yard 22.09.8-1 does not enforce HSTS headers

Vendor-lastyard n/a

Product-last_yard n/a

CWE ID-CWE-319

Cleartext Transmission of Sensitive Information

CVE-2020-5426

Credits

Scheduler for TAS can transmit privileged UAA token in plaintext

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs