CVE-2015-6671

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

CVE-2015-6671

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

CVE-2015-6671

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

CVE-2015-6671

Open edX edx-platform pre-2015-08-25 stores SAML SSO secrets in the database, enabling potential exposure of sensitive information via a database backup. The root cause is storage of SAML secrets in the database, which means that if a backup is accessed, context-dependent attackers may obtain sen...

How to Deploy and Troubleshoot ADC as a SAML IdP or SP

SAML is an authentication method which allows the Client to authenticate to a trusted third party before accessing protected resources. For a SAML setup, the authenticating party is called the Identity Provider IdP and the resource that the user is trying to access is called the Service Provider...

CVE-2015-6671: Exposure of Sensitive Information to an Unauthorized Actor

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

PT-2017-7047

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2015-08-25 Description The issue allows context-dependent attackers to obtain sensitive information by leveraging access to a database backup, as the database is used for storage of SAML SSO secrets...

Xxe

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

PYSEC-2017-67

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

DEBIAN-CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

CVE-2016-10127 affects PySAML2 and is an XML External Entity (XXE) vulnerability in SAML XML processing. The issue arises from how the library parses crafted SAML requests/responses, enabling potential data disclosure or other XXE consequences as described in connected sources. The CVE entry also...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127: Improper Restriction of XML External Entity Reference

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

An error during signature verification can be treated as a successful verification.

Security update for signature validation on LogoutRequest/LogoutResponse. In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling opensslverify depending on the signature...

StoreFront SAML Troubleshooting Guide

During the installation and configuration of the SAML functionality introduced with StoreFront 3.9, there are various items to be aware of when performing a successful configuration. Although there are other issues you might encounter, this document will try to provide direction to help resolve...

How to configure SAML Authentication-Test Configuration

A test page is available to help test that SAML authentication is working and configured correctly. This page bypasses any Storefront components and only verifies the SAML authentication...