CVE-2020-5402 — UAA fails to check the state parameter when authenticating with external IDPs
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating wit…
Published: 2020-02-27 · CVSS: 8.8 · CVSS 3.0
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7