Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
References
| Link | Resource |
|---|---|
| https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations | Exploit Third Party Advisory |
| https://github.com/GoGentoOSS/SAMLBase/commit/482cdf8c090e0f1179073034ebcb609ac7c3f5b3 | Patch Third Party Advisory |
| https://github.com/GoGentoOSS/SAMLBase/issues/3 | Issue Tracking Patch Third Party Advisory |
| https://www.kb.cert.org/vuls/id/475445 | Third Party Advisory US Government Resource |
| https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations | Exploit Third Party Advisory |
| https://github.com/GoGentoOSS/SAMLBase/commit/482cdf8c090e0f1179073034ebcb609ac7c3f5b3 | Patch Third Party Advisory |
| https://github.com/GoGentoOSS/SAMLBase/issues/3 | Issue Tracking Patch Third Party Advisory |
| https://www.kb.cert.org/vuls/id/475445 | Third Party Advisory US Government Resource |
Configurations
History
21 Nov 2024, 04:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations - Exploit, Third Party Advisory | |
| References | () https://github.com/GoGentoOSS/SAMLBase/commit/482cdf8c090e0f1179073034ebcb609ac7c3f5b3 - Patch, Third Party Advisory | |
| References | () https://github.com/GoGentoOSS/SAMLBase/issues/3 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://www.kb.cert.org/vuls/id/475445 - Third Party Advisory, US Government Resource |
Information
Published : 2018-07-24 15:29
Updated : 2024-11-21 04:08
NVD link : CVE-2018-5387
Mitre link : CVE-2018-5387
CVE.ORG link : CVE-2018-5387
JSON object : View
Products Affected
wizkunde
- samlbase