high7.5
CVE-2020-5304
The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter …
Impact
The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter to the /saml/login URI. This closes the current log and creates a new log with one line of data. The attacker can also insert malicious data and false entries.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Whitesourcesoftware | Whitesource | before 20.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://medium.com/%40venkatajayaram.yalla/whitesource-log-injection-vulnerability-cve-2020-5304-e543b7943c2b
- https://www.whitesourcesoftware.com/oss_security_vulnerabilities/
- https://medium.com/%40venkatajayaram.yalla/whitesource-log-injection-vulnerability-cve-2020-5304-e543b7943c2b
- https://www.whitesourcesoftware.com/oss_security_vulnerabilities/