CVE-2020-5406: VMware Tanzu Application Service For Vms

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling.

Affected products

• VMware Tanzu Application Service For Vms: from 2.6.0, before 2.6.18 (fixed in 2.6.18); from 2.7.0, before 2.7.11 (fixed in 2.7.11); from 2.8.0, before 2.8.5 (fixed in 2.8.5)

Published 2020-04-10. Last modified 2026-06-17.