GitHub Advisoryadvisory · Packagist

GHSA-7gh2-8q93-87hp Wizkunde SAMLBase SAML Bypass

HIGH Published 2022-05-13 Modified 2023-10-05 Official page ↗
Aliases
CVE-2018-5387
Ecosystem
Packagist
Packages
gogentooss/samlbase
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-347
Reviewed
2023-07-07

Affected packages

• Packagist gogentooss/samlbase: < 1.2.7 → fixed in 1.2.7

Description

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Related

Alias · CVE (1)

  • CVE-2018-5387 Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References