CVE-2011-1411 Improper Authentication in OpenSAML
MediumCVSS 5.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.opensaml/opensaml(Maven) | >= 2.4.0, < 2.4.3 | 2.4.3 |
| org.opensaml/opensaml(Maven) | >= 2.5.0, < 2.5.1 | 2.5.1 |
| org.opensaml/opensaml(Maven) | = 2.4.1 | No fix listed |
| shibboleth opensaml | = 2.4.0 | No fix listed |
| shibboleth opensaml | = 2.4.1 | No fix listed |
| shibboleth opensaml | = 2.4.2 | No fix listed |
| shibboleth opensaml | = 2.5.0 | No fix listed |
| shibboleth-identity-provider | <= 2.3.1 | No fix listed |
| shibboleth-identity-provider | = 2.0.0 | No fix listed |
| shibboleth-identity-provider | = 2.1.0 | No fix listed |
| shibboleth-identity-provider | = 2.1.1 | No fix listed |
| shibboleth-identity-provider | = 2.1.2 | No fix listed |
| shibboleth-identity-provider | = 2.1.3 | No fix listed |
| shibboleth-identity-provider | = 2.1.4 | No fix listed |
| shibboleth-identity-provider | = 2.1.5 | No fix listed |
| shibboleth-identity-provider | = 2.2.0 | No fix listed |
| shibboleth-identity-provider | = 2.2.1 | No fix listed |
| shibboleth-identity-provider | = 2.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- shibboleth.internet2.edu vendor-advisory
- DSA-2284 vendor-advisory
- www.oracle.com
- github.com
- 50994 third-party-advisory
- MDVSA-2013:150 vendor-advisory