PT-2023-14715 · Componentspace · Componentspace.Saml2

CVE-2022-45597 · Publicado 2023-03-24 · Atualizado 2026-07-05

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ComponentSpace.Saml2 version 4.4.0

Description The issue concerns missing SSL certificate validation at the application layer. According to the vendor, this is not considered a vulnerability because certificates are exchanged between trusted entities in a controlled manner, allowing for the use of self-signed certificates. The vendor emphasizes that validating certificates at the application layer is less critical than at the transport layer.

Recommendations For ComponentSpace.Saml2 version 4.4.0, consider implementing additional validation for SSL certificates at the application layer as a precautionary measure, even though the vendor does not consider this a vulnerability. However, since the vendor does not acknowledge this as a vulnerability, there is no official fix or patch provided. As a result, at the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2022-45597

Produtos afetados

Componentspace.Saml2

Referências · 7

• https://componentspace.com/documentation/saml-for-asp-net-core/ComponentSpace%20SAML%20for%20ASP.NET%20Core%20Release%20Notes.pdf · Nota
• https://osv.dev/vulnerability/CVE-2022-45597 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-45597 · Nota de Segurança
• http://componentspace.com · Nota
• https://t.me/cveNotify/187869 · Publicação no Telegram
• https://t.me/cvenotify/88798 · Publicação no Telegram
• http://componentspacesaml2.com · Nota