CVE-2020-5406

Name of the Vulnerable Software and Affected Versions VMware Tanzu Application Service for VMs versions 2.6.x prior to 2.6.18 VMware Tanzu Application Service for VMs versions 2.7.x prior to 2.7.11 VMware Tanzu Application Service for VMs versions 2.8.x prior to 2.8.5

Description The issue allows a malicious user with access to logs to gain unauthorized access to the database being used by Autoscaling, as database connection properties, including database username and password, are written to its log.

Recommendations For versions 2.6.x prior to 2.6.18, update to version 2.6.18 or later. For versions 2.7.x prior to 2.7.11, update to version 2.7.11 or later. For versions 2.8.x prior to 2.8.5, update to version 2.8.5 or later.