PT-2020-21402 · Saml2-Js · Saml2-Js

Published 2020-09-03 · Updated 2020-09-03

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions saml2-js versions prior to 2.0.5

Description The issue is related to an Authentication Bypass in the saml2-js package. It fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted assertion tokens indefinitely.

Recommendations Upgrade to version 2.0.5 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

GHSA-MFCP-34XW-P57X

Affected Products

Saml2-Js

References · 6

• https://osv.dev/vulnerability/GHSA-mfcp-34xw-p57x · Vendor Advisory
• https://github.com/Clever/saml2/pull/190 · Note
• https://github.com/Clever/saml2 · Note
• https://github.com/Clever/saml2/commit/ae0da4d0a0ea682a737be481e3bd78798be405c0 · Note
• https://snyk.io/vuln/SNYK-JS-SAML2JS-474637 · Note
• https://npmjs.com/advisories/1222 · Note