Vulnerability in Cloudfoundry User Account And Authentication
CVE-2023-20903
This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh token is issued to a client on behalf of a user from that identity provider, the administrator of the UAA deactivates the identity provider from the UAA. It is expected that the UAA would reject a refresh token during a refresh token grant, but it does not (hence the vulnerability). It will continue to issue access tokens to request presenting such refresh tokens, as if the identity provider was still active. As a result, clients with refresh tokens issued through the deactivated identity provider would still have access to Cloud Foundry resources until their refresh token expires (which defaults to 30 days).
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (33.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Cloudfoundry User Account And Authentication
- Cloud Foundry — versions All versions
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-20903?
- CVE-2023-20903 is a medium-severity vulnerability in Cloudfoundry User Account And Authentication, classified under Insufficient Session Expiration. CVSS score: 4.3/10. Published 2023-03-28.
- How severe is CVE-2023-20903?
- Medium severity. CVSS v3 base score is 4.3 out of 10.