// For flags

CVE-2021-3196

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0. When using federated identity management (authenticating via SAML through a third-party identity provider), an attacker can inject additional data into a signed SAML response being transmitted to the service provider (ID Bravura Security Fabric). The application successfully validates the signed values but uses the unsigned malicious values. An attacker with lower-privilege access to the application can inject the username of a high-privilege user to impersonate that user.

Se detectó un problema en Hitachi ID Bravura Security Fabric versiones 11.0.0 hasta 11.1.3, versiones 12.0.0 hasta 12.0.2 y versión 12.1.0. Cuando se usa la administración de identidad federada (autenticando por medio de SAML mediante un proveedor de identidad de terceros), un atacante puede inyectar datos adicionales en una respuesta SAML firmada que ha sido transmitida al proveedor de servicios (ID Bravura Security Fabric). La aplicación comprobada con éxito los valores firmados, pero usa los valores maliciosos sin firmar. Un atacante con acceso con privilegios más bajos a la aplicación puede inyectar el nombre de usuario de un usuario con privilegios altos para hacerse pasar por ese usuario

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-01-21 CVE Reserved
  • 2021-06-09 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-10-12 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-347: Improper Verification of Cryptographic Signature
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hitachi
Search vendor "Hitachi"
 Id Bravura Security Fabric
Search vendor "Hitachi" for product "Id Bravura Security Fabric"
 >= 11.0.0 <= 11.1.3
Search vendor "Hitachi" for product "Id Bravura Security Fabric" and version " >= 11.0.0 <= 11.1.3"
-
Affected
Hitachi
Search vendor "Hitachi"
 Id Bravura Security Fabric
Search vendor "Hitachi" for product "Id Bravura Security Fabric"
 >= 12.0.0 <= 12.0.2
Search vendor "Hitachi" for product "Id Bravura Security Fabric" and version " >= 12.0.0 <= 12.0.2"
-
Affected
Hitachi
Search vendor "Hitachi"
 Id Bravura Security Fabric
Search vendor "Hitachi" for product "Id Bravura Security Fabric"
 12.1.0
Search vendor "Hitachi" for product "Id Bravura Security Fabric" and version "12.1.0"
-
Affected