Auth bypass in VMware Single Sign-On For Tanzu
CVE-2020-5425
Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity providers, one can acquire the token of the other and thus operate with their permissions. Note: Foundation may be vulnerable only if: 1) The system zone is set up to use a SAML identity provider 2) There are internal users that have the same username as users in the external SAML provider 3) Those duplicate-named users have the scope to access the SSO operator dashboard 4) The vulnerability doesn't appear with LDAP because of chained authentication.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.9 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (52.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 52.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- VMware Single Sign-On For Tanzu
- VMware Tanzu Single Sign-On For — versions 1.11, 1.12, 1.13
Weakness classification (CWE)
References
- tanzu.vmware.com/security/cve-2020-5425 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-5425?
- CVE-2020-5425 is a high-severity vulnerability in VMware Single Sign-On For Tanzu, classified under Improper Authentication. CVSS score: 7.9/10. Published 2020-10-31.
- How severe is CVE-2020-5425?
- High severity. CVSS v3 base score is 7.9 out of 10.