PT-2023-14715 · Componentspace · Componentspace.Saml2

Published 2023-03-24 · Updated 2024-08-03 · CVE-2022-45597

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ComponentSpace.Saml2 version 4.4.0

Description The issue concerns missing SSL certificate validation at the application layer. According to the vendor, this is not considered a vulnerability because certificates are exchanged between trusted entities in a controlled manner, allowing for the use of self-signed certificates. The vendor emphasizes that validating certificates at the application layer is less critical than at the transport layer.

Recommendations For ComponentSpace.Saml2 version 4.4.0, consider implementing additional validation for SSL certificates at the application layer as a precautionary measure, even though the vendor does not consider this a vulnerability. However, since the vendor does not acknowledge this as a vulnerability, there is no official fix or patch provided. As a result, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-45597

Affected Products

Componentspace.Saml2

References · 6

• https://osv.dev/vulnerability/CVE-2022-45597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45597 · Security Note
• https://componentspace.com/documentation/saml-for-asp-net-core/ComponentSpace%20SAML%20for%20ASP.NET%20Core%20Release%20Notes.pdf · Note
• https://t.me/cvenotify/88798 · Telegram Post
• http://componentspacesaml2.com · Note
• http://componentspace.com · Note