5.8
CVE-2012-5352
- EPSS 2.52%
- Veröffentlicht 09.10.2012 23:55:05
- Zuletzt bearbeitet 16.06.2026 23:46:42
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginJava Open Single Sign-On Project Home (JOSSO) allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Josso ≫ Java Open Single Sign-on Project Home Version-
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.52% | 0.828 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.8 | 8.6 | 4.9 |
AV:N/AC:M/Au:N/C:P/I:P/A:N
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf
http://www.securityfocus.com/bid/55892
https://bugzilla.redhat.com/show_bug.cgi?id=865169
https://exchange.xforce.ibmcloud.com/vulnerabilities/79241