CVE-2021-23365 Authentication Bypass

🗓️ 26 Apr 2021 10:05:33Reported by snykType

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 is vulnerable to Authentication Bypass via Go XML parser, leading to SAML authentication bypass due to lack of XML integrity guarantee

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2021-23365	26 Apr 202110:00	–	attackerkb
CNNVD	tyk-identity-broker 授权问题漏洞	26 Apr 202100:00	–	cnnvd
CVE	CVE-2021-23365	26 Apr 202110:05	–	cve
EUVD	EUVD-2021-1267	7 Oct 202500:30	–	euvd
Github Security Blog	Authentication Bypass in tyk-identity-broker	23 Jun 202117:23	–	github
NVD	CVE-2021-23365	26 Apr 202110:15	–	nvd
OSV	GHSA-599H-8WPJ-75XJ Authentication Bypass in tyk-identity-broker	23 Jun 202117:23	–	osv
OSV	GO-2022-0906 Authentication Bypass in tyk-identity-broker in github.com/TykTechnologies/tyk-identity-broker	21 Aug 202415:29	–	osv
Prion	Authentication flaw	26 Apr 202110:15	–	prion
Positive Technologies	PT-2021-15465 · Tyk · Tyk-Identity-Broker	26 Apr 202100:00	–	ptsecurity

[
  {
    "product": "github.com/TykTechnologies/tyk-identity-broker",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "1.1.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.1.1
snyk	www.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKIDENTITYBROKER-1089720
github	www.github.com/TykTechnologies/tyk-identity-broker/commit/243092965b0f93a95a14cb882b5b9a3df61dd5c0
github	www.github.com/TykTechnologies/tyk-identity-broker/commit/46f70420e0911e4e8b638575e29d394c227c75d0
github	www.github.com/TykTechnologies/tyk-identity-broker/pull/147

26 Apr 2021 10:05Current

9.6High risk

Vulners AI Score9.6

CVSS 3.14.8

EPSS0.01011