CVE-2020-5407 Signature Wrapping Vulnerability with spring-security-saml2-service-provider

🗓️ 13 May 2020 17:00:15Reported by pivotalType

CVE-2020-5407 Signature Wrapping Vulnerability in Spring Security SAML2 Service Provider

Reporter	Title	Published	Views	Family All 17
BDU FSTEC	The vulnerability of the Spring Framework’s spring-security-saml2-service-provider component, which is used for securing industrial applications with Spring Security. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	26 Jan 202100:00	–	bdu_fstec
CNVD	VMware Spring Security Data Forgery Issue Vulnerability	14 May 202000:00	–	cnvd
CVE	CVE-2020-5407	13 May 202017:00	–	cve
EUVD	EUVD-2020-0457	7 Oct 202500:30	–	euvd
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	2 Feb 202105:06	–	ibm
Github Security Blog	Signature wrapping vulnerability in Spring Security	5 Jun 202016:13	–	github
NVD	CVE-2020-5407	13 May 202017:15	–	nvd
Oracle	Oracle Critical Patch Update Advisory - April 2021	20 Apr 202100:00	–	oracle
Oracle	Oracle Critical Patch Update Advisory - January 2021	19 Jan 202100:00	–	oracle
Oracle	Oracle Critical Patch Update Advisory - October 2020	20 Oct 202000:00	–	oracle

[
  {
    "product": "Spring Security",
    "vendor": "Spring by VMware",
    "versions": [
      {
        "lessThan": "5.2.4",
        "status": "affected",
        "version": "5.2",
        "versionType": "custom"
      },
      {
        "lessThan": "5.3.2",
        "status": "affected",
        "version": "5.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E
oracle	www.oracle.com/security-alerts/cpujan2021.html
oracle	www.oracle.com/security-alerts/cpuApr2021.html
lists	www.lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E
lists	www.lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E
tanzu	www.tanzu.vmware.com/security/cve-2020-5407
oracle	www.oracle.com/security-alerts/cpuoct2020.html

14 Jun 2021 17:20Current

8.9High risk

Vulners AI Score8.9

EPSS0.00665

CWE-347