GitHub Advisoryadvisory · Hex

GHSA-h3rw-77w7-92gf Samly access control vulnerability

CRITICAL Published 2024-02-11 Modified 2024-10-21 Official page ↗
Aliases
CVE-2024-25718
Ecosystem
Hex
Packages
Samly
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-400, CWE-613
Reviewed
2024-02-12

Affected packages

• Hex Samly: < 1.4.0 → fixed in 1.4.0

Description

In the Samly package before 1.4.0 for Elixir, `Samly.State.Store.get_assertion/3` can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2024-25718 In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References