Design/Logic Flaw

2020-10-2815:15:00

PRIOn knowledge base

www.prio-n.com

0.002 Low

EPSS

Percentile

58.8%

JSON

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session.

CPENameOperatorVersion
identity_providerge3.0.0
identity_providerlt3.4.6

CPE	Name	Operator	Version
	identity_provider	ge	3.0.0
	identity_provider	lt	3.4.6

References

shibboleth.net/community/advisories/secadv_20191002.txt

0.002 Low

EPSS

Percentile

58.8%

JSON

Related for PRION:CVE-2020-27978