CVE-2024-47832
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-47832
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47832.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-47832
- Aliases
- Related
- Published
- 2024-10-09T19:15:14Z
- Modified
- 2025-03-06T18:08:42Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.
- References