Lucene search

MitreCVE-2018-1000165

HistoryApr 18, 2018 - 7:29 p.m.

CVE-2018-1000165

2018-04-1819:29:00

CWE-732

mitre

web.nvd.nist.gov

cve-2018-1000165

lightsaml

vulnerability

incorrect access control

signature validation

xmldsig

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

35.1%

JSON

LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.

Affected configurations

Nvd

Node

lightsamllightsamlRange<1.3.5

VendorProductVersionCPE
lightsamllightsaml*cpe:2.3:a:lightsaml:lightsaml:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lightsaml	lightsaml	*	cpe:2.3:a:lightsaml:lightsaml::::::::

References

github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a

github.com/lightSAML/lightSAML/releases/tag/1.3.5

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

35.1%

JSON

Related for CVE-2018-1000165