CVEvulnerability
CVE-2021-33054
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-06-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-347
Description
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
Affected configurations
• inverse sogo (>= 2.0.6 < 2.4.1)
• inverse sogo (>= 3.0.0 < 5.1.1)
• debian debian linux 9.0
• debian debian linux 10.0
• debian debian linux 11.0
Related
Weakness · CWE (1)
- CWE-347 Improper Verification of Cryptographic Signature weakness
References
- https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html Third Party Advisory
- https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md Release Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/07/msg00007.html Mailing List, Third Party Advisory
- https://www.debian.org/security/2021/dsa-5029 Third Party Advisory
- https://www.sogo.nu/news.html Product
- https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html Third Party Advisory
- https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md Release Notes, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/07/msg00007.html Mailing List, Third Party Advisory
- https://www.debian.org/security/2021/dsa-5029 Third Party Advisory
- https://www.sogo.nu/news.html Product