PT-2020-18352 · Sustainsys · Sustainsys.Saml2

Anders Abel · Published 2020-03-25 · Updated 2021-03-24 · CVE-2020-5261

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sustainsys.Saml2 versions 2.0.0 through 2.4.x

Description The issue concerns a faulty implementation of Token Replay Detection, an important defense measure for Single Sign On solutions. This faulty implementation affects the specified versions of the Sustainsys.Saml2 NuGet package for ASP.NET. Token Replay Detection is crucial for preventing replay attacks, where an attacker intercepts and reuses a valid token to gain unauthorized access. The correct implementation of Token Replay Detection is essential for the security of Single Sign On solutions.

Recommendations For versions 2.0.0 through 2.4.x, update to version 2.5.0 or later, as it includes the necessary patches for the faulty Token Replay Detection implementation. At the moment, there is no information about other workarounds for the affected versions.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2020-5261

GHSA-G6J2-CH25-5MMV

Affected Products

Sustainsys.Saml2

References · 7

• https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241 · Patch
• https://osv.dev/vulnerability/CVE-2020-5261 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g6j2-ch25-5mmv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5261 · Security Note
• https://github.com/Sustainsys/Saml2/issues/711 · Note
• https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv · Note
• https://t.me/cvenotify/2115 · Telegram Post