Lucene search

SnykCVELIST:CVE-2021-23365

HistoryApr 26, 2021 - 12:00 a.m.

CVE-2021-23365 Authentication Bypass

2021-04-2600:00:00

snyk

www.cve.org

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.2%

JSON

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

CNA Affected

[
  {
    "product": "github.com/TykTechnologies/tyk-identity-broker",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "1.1.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/TykTechnologies/tyk-identity-broker/commit/243092965b0f93a95a14cb882b5b9a3df61dd5c0

github.com/TykTechnologies/tyk-identity-broker/commit/46f70420e0911e4e8b638575e29d394c227c75d0

github.com/TykTechnologies/tyk-identity-broker/pull/147

github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.1.1

snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKIDENTITYBROKER-1089720

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.2%

JSON

Related for CVELIST:CVE-2021-23365