// For flags

CVE-2009-3474

 

Severity Score

7.5
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.

OpenSAML v2.x anterior a v2.2.1 y XMLTooling v1.x anterior a v1.2.1, utilizado por Internet2 Shibboleth Service Provider v2.x anterior a v2.2.1,no siguen el atributo Use del elemento KeyDescriptor, lo cual permite a atacantes remotos utilizar un certificado para la firma y encriptación, cuando esta designado para un solo fin, debilitando potencialmente el propósito de aplicación de seguridad del certificado.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-09-29 CVE Reserved
  • 2009-09-29 CVE Published
  • 2024-02-16 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-310: Cryptographic Issues
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.0
Search vendor "Internet2" for product "Opensaml" and version "2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.1"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.0
Search vendor "Internet2" for product "Opensaml" and version "2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.2"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.0
Search vendor "Internet2" for product "Opensaml" and version "2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3b
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3b"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.0
Search vendor "Internet2" for product "Opensaml" and version "2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3f
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3f"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.0
Search vendor "Internet2" for product "Opensaml" and version "2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.0
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.0"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.0
Search vendor "Internet2" for product "Opensaml" and version "2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.1"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.0
Search vendor "Internet2" for product "Opensaml" and version "2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.2"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.1.0
Search vendor "Internet2" for product "Opensaml" and version "2.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.1"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.1.0
Search vendor "Internet2" for product "Opensaml" and version "2.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.2"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.1.0
Search vendor "Internet2" for product "Opensaml" and version "2.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3b
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3b"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.1.0
Search vendor "Internet2" for product "Opensaml" and version "2.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3f
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3f"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.1.0
Search vendor "Internet2" for product "Opensaml" and version "2.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.0
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.0"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.1.0
Search vendor "Internet2" for product "Opensaml" and version "2.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.1"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.1.0
Search vendor "Internet2" for product "Opensaml" and version "2.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.2"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.2.0
Search vendor "Internet2" for product "Opensaml" and version "2.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.1"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.2.0
Search vendor "Internet2" for product "Opensaml" and version "2.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.2"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.2.0
Search vendor "Internet2" for product "Opensaml" and version "2.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3b
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3b"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.2.0
Search vendor "Internet2" for product "Opensaml" and version "2.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3f
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3f"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.2.0
Search vendor "Internet2" for product "Opensaml" and version "2.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.0
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.0"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.2.0
Search vendor "Internet2" for product "Opensaml" and version "2.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.1"
-
Affected
Internet2
Search vendor "Internet2"
Opensaml
Search vendor "Internet2" for product "Opensaml"
2.2.0
Search vendor "Internet2" for product "Opensaml" and version "2.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.2"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.0.1
Search vendor "Internet2" for product "Xmltooling" and version "1.0.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.1"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.0.1
Search vendor "Internet2" for product "Xmltooling" and version "1.0.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.2"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.0.1
Search vendor "Internet2" for product "Xmltooling" and version "1.0.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3b
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3b"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.0.1
Search vendor "Internet2" for product "Xmltooling" and version "1.0.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3f
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3f"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.0.1
Search vendor "Internet2" for product "Xmltooling" and version "1.0.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.0
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.0"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.0.1
Search vendor "Internet2" for product "Xmltooling" and version "1.0.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.1"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.0.1
Search vendor "Internet2" for product "Xmltooling" and version "1.0.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.2"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.0
Search vendor "Internet2" for product "Xmltooling" and version "1.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.1"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.0
Search vendor "Internet2" for product "Xmltooling" and version "1.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.2"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.0
Search vendor "Internet2" for product "Xmltooling" and version "1.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3b
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3b"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.0
Search vendor "Internet2" for product "Xmltooling" and version "1.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3f
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3f"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.0
Search vendor "Internet2" for product "Xmltooling" and version "1.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.0
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.0"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.0
Search vendor "Internet2" for product "Xmltooling" and version "1.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.1"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.0
Search vendor "Internet2" for product "Xmltooling" and version "1.1.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.2"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.1
Search vendor "Internet2" for product "Xmltooling" and version "1.1.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.1"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.1
Search vendor "Internet2" for product "Xmltooling" and version "1.1.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.2"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.1
Search vendor "Internet2" for product "Xmltooling" and version "1.1.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3b
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3b"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.1
Search vendor "Internet2" for product "Xmltooling" and version "1.1.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3f
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3f"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.1
Search vendor "Internet2" for product "Xmltooling" and version "1.1.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.0
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.0"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.1
Search vendor "Internet2" for product "Xmltooling" and version "1.1.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.1"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.1.1
Search vendor "Internet2" for product "Xmltooling" and version "1.1.1"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.2"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.2.0
Search vendor "Internet2" for product "Xmltooling" and version "1.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.1"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.2.0
Search vendor "Internet2" for product "Xmltooling" and version "1.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3.2"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.2.0
Search vendor "Internet2" for product "Xmltooling" and version "1.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3b
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3b"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.2.0
Search vendor "Internet2" for product "Xmltooling" and version "1.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
1.3f
Search vendor "Internet2" for product "Shibboleth-sp" and version "1.3f"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.2.0
Search vendor "Internet2" for product "Xmltooling" and version "1.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.0
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.0"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.2.0
Search vendor "Internet2" for product "Xmltooling" and version "1.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.1
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.1"
-
Affected
Internet2
Search vendor "Internet2"
Xmltooling
Search vendor "Internet2" for product "Xmltooling"
1.2.0
Search vendor "Internet2" for product "Xmltooling" and version "1.2.0"
-
Affected
in Internet2
Search vendor "Internet2"
Shibboleth-sp
Search vendor "Internet2" for product "Shibboleth-sp"
2.2
Search vendor "Internet2" for product "Shibboleth-sp" and version "2.2"
-
Affected