GitHub Advisoryadvisory · Packagist

GHSA-vg4f-8v9q-5c3x LightSAML Incorrect Access Control vulnerability

HIGH Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2018-1000165
Ecosystem
Packagist
Packages
lightsaml/lightsaml
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-732
Reviewed
2024-04-23

Affected packages

• Packagist lightsaml/lightsaml: < 1.3.5 → fixed in 1.3.5

Description

LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in `src/LightSaml/Model/XmlDSig/` that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.

Related

Alias · CVE (1)

  • CVE-2018-1000165 LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References