PT-2018-16940 · Wizkunde · Wizkunde Samlbase

Publicado 2018-07-24 · Atualizado 2022-06-01 · CVE-2018-5387

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wizkunde SAMLBase (affected versions not specified)

Description The issue arises from the incorrect utilization of XML DOM traversal and canonicalization APIs, which may allow an attacker to manipulate SAML data without invalidating its cryptographic signature. This could potentially enable the attacker to bypass authentication to SAML service providers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-287

CWE-347

Identificadores relacionados

CVE-2018-5387

GHSA-7GH2-8Q93-87HP

Produtos afetados

Wizkunde Samlbase

Referências · 9

• 🔥 https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations · Exploit
• ❌ https://github.com/GoGentoOSS/SAMLBase/issues/3 · Correção, Deleted
• https://osv.dev/vulnerability/GHSA-7gh2-8q93-87hp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5387 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-5387 · Aviso do Fabricante
• ❌ https://github.com/GoGentoOSS/SAMLBase/commit/482cdf8c090e0f1179073034ebcb609ac7c3f5b3 · Correção, Deleted
• https://t.me/cvenotify/28212 · Publicação no Telegram
• https://kb.cert.org/vuls/id/475445 · Nota
• ❌ https://github.com/GoGentoOSS/SAMLBase · Nota, Deleted