Lucene search
HistoryNov 28, 2022 - 3:15 p.m.
CVE-2022-41912
vulnerability
crewjam/saml
authentication bypass
saml
assertion elements
upgrade
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.006
Percentile
78.0%
The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.
Affected configurations
Node
saml_projectsamlRange<0.4.9go
| Vendor | Product | Version | CPE |
|---|---|---|---|
| saml_project | saml | * | cpe:2.3:a:saml_project:saml:*:*:*:*:*:go:*:* |
Related
redhatcve
redhatcve
veracode
veracode
Authentication Bypass
2022-11-22 05:45:33
github
github
debiancve
debiancve
CVE-2022-41912
2022-11-28 15:15:10
ubuntucve
ubuntucve
CVE-2022-41912
2022-11-28 00:00:00
cve
cve
CVE-2022-41912
2022-11-28 15:15:10
openvas
openvas
prion
prion
Authentication flaw
2022-11-28 15:15:00
cvelist
cvelist
redhat
redhat
osv
osv
crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication
2022-11-29 23:55:54
Authentication bypass in github.com/crewjam/saml
2022-11-29 18:03:21
CVE-2022-41912
2022-11-28 15:15:10
ibm
ibm
freebsd
freebsd
Grafana -- Stored XSS in ResourcePicker component
2022-12-16 00:00:00
Grafana -- Spoofing originalUrl of snapshots
2023-01-25 00:00:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.006
Percentile
78.0%
Related for NVD:CVE-2022-41912