CVE-2020-5420

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that returns specially crafted HTTP responses that crash the Gorouters.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

Vendor	Product	Versions
Cloud Foundry	Routing	>= All, < 0.206.0
Cloud Foundry	CF Deployment	>= All, < 13.15.0

References

https://www.cloudfoundry.org/blog/cve-2020-5420Vendor Advisory
https://www.cloudfoundry.org/blog/cve-2020-5420Vendor Advisory

Timeline

Published: Sep 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-54216.5In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections CVE-2020-54226.5BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed CVE-2020-54237.5CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacke CVE-2020-54257.9Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to u CVE-2020-54269.8Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. CVE-2020-54277.2In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, versions 2.5.x prior 2.5.4, an application is vulnerable to SQL injection when req CVE-2020-54286.0In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries i CVE-2020-54968.8FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c.CVE-2020-54976.1The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsa CVE-2020-54999.8Baidu Rust SGX SDK through 1.0.8 has an enclave ID race. There are non-deterministic results in which, sometimes, two global IDs are the sam CVE-2020-55014.3phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.CVE-2020-55026.5phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.