GHSA-qwwj-qj3f-9hv7

Source

https://github.com/advisories/GHSA-qwwj-qj3f-9hv7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qwwj-qj3f-9hv7/GHSA-qwwj-qj3f-9hv7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qwwj-qj3f-9hv7

Aliases

CVE-2011-1411

Published

2022-05-17T05:02:41Z

Modified

2024-12-07T05:39:37Z

Summary

Improper Authentication in OpenSAML

Details

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

Database specific

{
    "cwe_ids": [
        "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-13T17:17:40Z",
    "nvd_published_at": "2011-09-02T23:55:00Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.opensaml:opensaml

Package

Name: org.opensaml:opensaml; View open source insights on deps.dev
Purl: pkg:maven/org.opensaml/opensaml

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0

Fixed

2.4.3

Affected versions

2.*

2.4.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qwwj-qj3f-9hv7/GHSA-qwwj-qj3f-9hv7.json"

Maven / org.opensaml:opensaml

Package

Name: org.opensaml:opensaml; View open source insights on deps.dev
Purl: pkg:maven/org.opensaml/opensaml

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5.0

Fixed

2.5.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qwwj-qj3f-9hv7/GHSA-qwwj-qj3f-9hv7.json"