CVE-2020-5402

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

CVE-2020-5400

Cloud Foundry Cloud Controller CAPI, versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected b...

CVE-2020-5400

Cloud Foundry Cloud Controller CAPI, versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected b...

CVE-2020-5401

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

Null pointer dereference

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

Design/Logic Flaw

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

Design/Logic Flaw

Cloud Foundry Cloud Controller CAPI, versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected b...

CVE-2020-5402

The CVE-2020-5402 issue affects Cloud Foundry UAA (and related deployments) where versions prior to 74.14.0 allow CSRF via the OAuth2 state parameter not being validated in the external identity provider callback. The core vulnerability is a missing check in the callback flow, impacting authentic...

CVE-2020-5402 UAA fails to check the state parameter when authenticating with external IDPs

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

CVE-2020-5401 Cloud Foundry GoRouter is vulnerable to cache poisoning

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

CVE-2020-5401

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

CVE-2020-5401

CVE-2020-5401 affects Cloud Foundry Routing Release (prior to 0.197.0) which includes GoRouter. Malicious clients can send invalid headers, causing caching layers to reject subsequent legitimate clients. The vulnerability, described in multiple sources, results in degraded access for users to app...

CVE-2020-5400 Cloud Controller logs environment variables from app manifests

Cloud Foundry Cloud Controller CAPI, versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected b...

CVE-2020-5400

CVE-2020-5400 affects Cloud Foundry Cloud Controller (CAPI) prior to 1.91.0. The issue arises because background-job logging may capture environment properties (e.g., credentials) from app manifests, enabling a malicious user with access to logs to exfiltrate sensitive credentials. Public referen...

CVE-2020-5401: Return of Wrong Status Code

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app...

PT-2020-18457

Name of the Vulnerable Software and Affected Versions Cloud Foundry Routing Release versions prior to 0.197.0 Description The issue allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app. This is a cache poisoning...

PT-2020-18458

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 74.14.0 Description A CSRF issue exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers. Recommendations For versions prior t...

CVE-2020-5402: Cross-Site Request Forgery (CSRF)

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

CVE-2020-5400: Insufficiently Protected Credentials

Cloud Foundry Cloud Controller CAPI, versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected b...

PT-2020-18456

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller CAPI versions prior to 1.91.0 Description The issue allows a malicious user with access to logs to potentially gain unauthorized access to resources protected by credentials, as sensitive information such as...