CVE-2020-5402
High
Description
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.
SeverityHigh
CVSS8.8
Exploit probability—
ProductCloudfoundry Cf-deployment
PublishedFeb 27, 2020
First seenFeb 27, 2020
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- cloudfoundry cf-deployment12.33.0 or later
- cloudfoundry user_account_and_authentication74.14.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cf-deployment | v < 12.33.0 | 12.33.0 |
| cloudfoundry user_account_and_authentication | v < 74.14.0 | 74.14.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.