CVE-2013-2279 CA SiteMinder Federation (FSS) 12.5, 12.0, and r6; Federation (Standalone) 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify...
HighCVSS 7.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CA SiteMinder Federation (FSS) 12.5, 12.0, and r6; Federation (Standalone) 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siteminder agent for sharepoint 2010 | All versions | No fix listed |
| siteminder federation 12.0 | All versions | No fix listed |
| siteminder federation 12.1 | All versions | No fix listed |
| siteminder federation 12.5 | All versions | No fix listed |
| siteminder federation r6.0 | All versions | No fix listed |
| siteminder for secure proxy server 12.0 | All versions | No fix listed |
| siteminder for secure proxy server 12.5 | All versions | No fix listed |
| siteminder for secure proxy server 6.0 | All versions | No fix listed |
References
- 20130319 CA20130319-01: Security Notice for SiteMinder products using SAML mailing-list
- 52610 third-party-advisory vendor-advisory
- 58609 vdb-entry
- support.ca.com