Cloudfoundry Credhub vulnerabilities

2 CVEs affecting Cloudfoundry Credhub, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-5399, published 2020-02-12.

More from Cloudfoundry.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-3801, published 2019-04-25. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker…
• CVE-2020-5399, published 2020-02-12. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL…