TI-2023-07318 Aliases CVE-2023-20903 GHSA-5rqc-wqwj-478f

Insufficient session expiration in Cloud Foundry

LOW 20CWE-613Published 2023-03-28 · Updated 2025-02-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-613.

Summary

This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh token is issued to a client on behalf of a user from that identity provider, the administrator of the UAA deactivates the identity provider from the UAA. It is expected that the UAA would reject a refresh token during a refresh token grant, but it does not (hence the vulnerability). It will continue to issue access tokens to request presenting such refresh tokens, as if the identity provider was still active. As a result, clients with refresh tokens issued through the deactivated identity provider would still have access to Cloud Foundry resources until their refresh token expires (which defaults to 30 days).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00404 34th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Cloud Foundry	All versions	—	No fix listed	CNA

Cloud Foundry Vendor— Affected All versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cloudfoundry:user_account_and_authentication::::::::	all versions	Vulnerable	CloudFoundry Foundation

cpe:2.3:a:cloudfoundry:user_account_and_authentication:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·CloudFoundry Foundation

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-20903
2026-10-03 Alias added: GHSA-5rqc-wqwj-478f

References

Advisory 1

https://www.cloudfoundry.org/blog/cve-2023-20903-tokens-for-inactivated-idps-are-not-revoked-and-remain-valid-until-expiration/

TI-2019-08436 Privilege Escalation via Blind SCIM Injection in UAA CVSS 3.1HIGH 8.8
TI-2016-00656 The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through… CVSS 3.1HIGH 8.8
TI-2020-04448 UAA fails to check the state parameter when authenticating with external IDPs CVSS 3.1HIGH 8.8
TI-2021-05045 Information disclosure in Cloud Foundry UAA server CVSS 3.1HIGH 7.5
TI-2019-08447 Cloud Foundry UAA logs query parameters in tomcat access file CVSS 3.1HIGH 7.5
TI-2019-08450 UAA logs all query parameters with debug logging level CVSS 3.1MEDIUM 6.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences