9.8
CVE-2022-41912
- EPSS 0.29%
- Veröffentlicht 28.11.2022 15:15:10
- Zuletzt bearbeitet 21.11.2024 07:24:03
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
Logincrewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements
The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Saml Project ≫ Saml SwPlatformgo Version < 0.4.9
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.29% | 0.522 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| security-advisories@github.com | 9.1 | 3.9 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.