GitHub Advisoryadvisory · NuGet

GHSA-g6j2-ch25-5mmv Missing Token Replay Detection in Saml2 Authentication services for ASP.NET

HIGH Published 2020-03-25 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-5261
Ecosystem
NuGet
Packages
Sustainsys.Saml2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-294
Reviewed
2020-03-25

Affected packages

• NuGet Sustainsys.Saml2: >= 2.0.0, < 2.5.0 → fixed in 2.5.0

Description

Impact Token Replay Detection is an important defence in depth measure for Single Sign On solutions. In all previous 2.X versions, the Token Replay Detection is not properly implemented. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Patches The 2.5.0 version is patched. Workarounds There are no workarounds with existing versions. Fixing the issue requires code updates. References https://en.wikipedia.org/wiki/Replay_attack For more information If you have any questions or comments about this advisory: • Comment on #711. • Email us at [email protected] if you think that there are further security issues.

Related

Alias · CVE (1)

  • CVE-2020-5261 Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty… vulnerability

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References