CVE-2020-5304

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-08 · updated 2026-06-17
Weakness: CWE-116

Description

The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter to the /saml/login URI. This closes the current log and creates a new log with one line of data. The attacker can also insert malicious data and false entries.

Affected products

Whitesourcesoftware Whitesource: before 20.4.1 — fixed in 20.4.1

How to fix

Upgrade to a fixed version: Whitesourcesoftware Whitesource 20.4.1. Check the vendor advisory for mitigations.

References

https://medium.com/%40venkatajayaram.yalla/whitesource-log-injection-vulnerability-cve-2020-5304-e543b7943c2b
https://www.whitesourcesoftware.com/oss_security_vulnerabilities/
https://medium.com/%40venkatajayaram.yalla/whitesource-log-injection-vulnerability-cve-2020-5304-e543b7943c2b
https://www.whitesourcesoftware.com/oss_security_vulnerabilities/

Get alerted when CVE-2020-5304 or the next vulnerability affects your stack