GitHub Advisoryadvisory · Maven

GHSA-qwwj-qj3f-9hv7 Improper Authentication in OpenSAML

MEDIUM Published 2022-05-17 Modified 2022-07-13 Official page ↗
Aliases
CVE-2011-1411
Ecosystem
Maven
Packages
org.opensaml:opensaml
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2022-07-13

Affected packages

• Maven org.opensaml:opensaml: >= 2.4.0, < 2.4.3 → fixed in 2.4.3 • Maven org.opensaml:opensaml: >= 2.5.0, < 2.5.1 → fixed in 2.5.1

Description

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

Related

Alias · CVE (1)

  • CVE-2011-1411 Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References