CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-0486 – Shibboleth 2 XML Injection
https://notcve.org/view.php?id=CVE-2018-0486
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD. Shibboleth XMLTooling-C en versiones anteriores a la 1.6.3, tal y como se emplea en Shibboleth Service Provider en versiones anteriores a la 2.6.0 en Windows y otros productos, gestiona de manera incorrecta las firmas digitales de datos de atributos de usuario. Esto permite que atacantes remotos obtengan información sensible o lleven a cabo ataques de suplantación mediante una DTD manipulado. RedTeam Pentesting discovered that the shibd service of Shibboleth 2 does not extract SAML attribute values in a robust manner. By inserting XML entities into a SAML response, attackers may truncate attribute values without breaking the document's signature. • http://www.securitytracker.com/id/1040177 https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html https://lists.debian.org/debian-security-announce/2018/msg00007.html https://shibboleth.net/community/advisories/secadv_20180112.txt https://www.debian.org/security/2018/dsa-4085 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2017-16852
https://notcve.org/view.php?id=CVE-2017-16852
shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763. shibsp/metadata/DynamicMetadataProvider.cpp en el plugin Dynamic MetadataProvider en Shibboleth Service Provider, en versiones anteriores a la 2.6.1, no se configura correctamente con los plugins MetadataFilter y no realiza las verificaciones de seguridad críticas como la verificación de firmas, cumplimiento de los periodos de validez y otras comprobaciones específicas de despliegues. Esta vulnerabilidad también se conoce como SSPCPP-763. • https://bugs.debian.org/881857 https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=b66cceb0e992c351ad5e2c665229ede82f261b16 https://lists.debian.org/debian-lts-announce/2017/11/msg00025.html https://shibboleth.net/community/advisories/secadv_20171115.txt https://www.debian.org/security/2017/dsa-4038 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 8.1EPSS: 1%CPEs: 3EXPL: 0CVE-2017-16853
https://notcve.org/view.php?id=CVE-2017-16853
The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105. La clase DynamicMetadataProvider en saml/saml2/metadata/impl/DynamicMetadataProvider.cpp en OpenSAML-C en OpenSAML, en versiones anteriores a la 2.6.1, no se configura correctamente con los plugins MetadataFilter y no realiza las verificaciones de seguridad críticas como la verificación de firmas, cumplimiento de los periodos de validez y otras comprobaciones específicas de despliegues. Esta vulnerabilidad también se conoce como CPPOST-105. • http://www.securityfocus.com/bid/101898 https://bugs.debian.org/881856 https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html https://shibboleth.net/community/advisories/secadv_20171115.txt https://www.debian.org/security/2017/dsa-4039 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14313 – Shibboleth <= 1.6 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-14313
The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg(). La función shibboleth_login_form en shibboleth.php en el plugin Shibboleth en versiones anteriores a la 1.8 para WordPress es propenso a sufrir una vulnerabilidad XSS debido a un uso incorrecto de add_query_arg(). The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.7 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg(). • http://www.debian.org/security/2017/dsa-3973 https://bugs.debian.org/874416 https://github.com/michaelryanmcneill/shibboleth/commit/1d65ad6786282d23ba1865f56e2fd19188e7c26a https://wpvulndb.com/vulnerabilities/8901 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1796 – Java: PKIX Trust Engines Exhibit Critical Flaw In Trusted Names Evaluation
https://notcve.org/view.php?id=CVE-2015-1796
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor. Los motores de confianza PKIX en Shibboleth Identity Provider anterior a 2.4.4 y OpenSAML Java (OpenSAML-J) anterior a 2.6.5 confían en los certificados X.509 de candidatos cuando nombres no confiables están disponibles para el identificador de entidad, lo que permite a atacantes remotos suplantar una entidad a través de un certificado emitido por una ancla de confianza shibmd:KeyAuthority. It was found that PKIX trust components allowed an X.509 credential to be trusted if no trusted names were available for the entityID. An attacker could use a certificate issued by a shibmd:KeyAuthority trust anchor to impersonate an entity within the scope of that keyAuthority. • http://rhn.redhat.com/errata/RHSA-2015-1176.html http://rhn.redhat.com/errata/RHSA-2015-1177.html http://www.securityfocus.com/bid/75370 https://shibboleth.net/community/advisories/secadv_20150225.txt https://access.redhat.com/security/cve/CVE-2015-1796 https://bugzilla.redhat.com/show_bug.cgi?id=1196619 • CWE-254: 7PK - Security Features •