CVE-2020-13415

{"id": "CVE-2020-13415", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-05-22T21:15:12.817", "references": [{"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#xml-signature-wrapping-in-saml", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://docs.aviatrix.com/HowTos/security_bulletin_article.html#xml-signature-wrapping-in-saml", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (even if that SAML assertion has expired or is from a user who is not authorized to access Aviatrix), aka XML Signature Wrapping."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Aviatrix Controller versiones hasta 5.1. Un atacante con cualquier aserci\u00f3n SAML firmada desde el Identity Provider puede establecer una conexi\u00f3n (incluso si esa aserci\u00f3n SAML ha expirado o es desde un usuario que no est\u00e1 autorizado para acceder a Aviatrix), tambi\u00e9n se conoce como XML Signature Wrapping."}], "lastModified": "2024-11-21T05:01:12.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71289F05-505B-46CC-829D-901A8DE7D730", "versionEndIncluding": "5.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}