PT-2022-16483

Name of the Vulnerable Software and Affected Versions Shibboleth Identity Provider OIDC OP plugin versions prior to 3.0.4 Description The issue allows server-side request forgery SSRF due to insufficient restriction of the request uri parameter. This enables attackers to interact with arbitrary...

CVE-2022-24129: Server-Side Request Forgery (SSRF)

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...