Vulnerability · Published Feb 27, 2020 · Assigned by pivotal
CVE-2020-5402UAA fails to check the state parameter when authenticating with external IDPs
High 8.8
In plain English
A high-severity cross-site request forgery in UAA from Cloud Foundry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.0)8.8High
Exploit odds (30 days)0.5%top 57.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloud Foundry | UAA | unspecified – before v74.14.0 |
Weakness: CWE-352 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.cloudfoundry.org/blog/cve-2020-5402 x_refsource_CONFIRM