GO-2022-1129 Authentication bypass in github.com/crewjam/saml

Authentication bypass is possible when processing SAML responses containing multiple Assertion elements...

CVE-2022-41912

An authentication bypass flaw was discovered in the crewjam/saml go package. A remote unauthenticated attacker could trigger it by sending a SAML request. This would allow an escalation of privileges and then enable compromising system integrity...

CVE-2022-41912

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version...

Authentication flaw

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version...

CVE-2022-41912

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version...

PT-2022-26143 · Unknown · Crewjam/Saml

Name of the Vulnerable Software and Affected Versions: crewjam/saml go library versions prior to 0.4.9 Description: The issue concerns an authentication bypass when processing SAML responses containing multiple Assertion elements. This has been corrected in version 0.4.9. There are no workarounds...

CVE-2022-41912

Removed by vendor...

CVE-2022-41912 crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version...

CVE-2022-41912

Affected software: crewjam/saml Go library

CVE-2022-41912: Improper Authentication

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version...

CVE-2022-41912 crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version...

SAML 授权问题漏洞

SAML is a library for Ross Kinder individual developers that contains a partial implementation of the saml standard in golang. That is, it allows third parties to authenticate your users, or allows third parties to rely on us to authenticate their users. There is an authorization issue...

CVE-2022-41912 crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version...

Authentication Bypass

github.com/crewjam/saml is vulnerable to authentication bypass. The vulnerability exists in multiple functions of serviceprovider.go when processing SAML responses containing multiple assertion elements which allows an attacker to bypass the signature...

Siemens Mendix SAML Module Certification Bypass Vulnerability

Siemens Mendix SAML Module is an application module from Siemens, Germany. It is used to grant access to Mendix applications based on the end-user's identity in your identity provider. An authentication bypass vulnerability exists in Siemens Mendix SAML Module, which could be exploited by an...

CVE-2022-44457

A vulnerability has been identified in Mendix SAML Mendix 7 compatible All versions = V1.17.0 = V2.3.0 = V3.3.1 = V3.3.0 V3.3.4. Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option 'Allow Idp Initiated...

CVE-2022-44457

A vulnerability has been identified in Mendix SAML Mendix 7 compatible All versions = V1.17.0 = V2.3.0 = V3.3.1 = V3.3.0 V3.3.4. Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option 'Allow Idp Initiated...

Default configuration

A vulnerability has been identified in Mendix SAML Mendix 7 compatible All versions = V1.17.0 = V2.3.0 = V3.3.1 = V3.3.0 V3.3.4. Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option 'Allow Idp Initiated...

CVE-2022-44457

CVE-2022-44457 affects Mendix SAML modules across Mendix 7/8/9 tracks. The issue arises when the non-default configuration option Allow Idp Initiated Authentication is enabled, yielding insufficient protection against packet capture replay. The record notes this as an incomplete fix for CVE-2022-...

CVE-2022-44457: Authentication Bypass by Capture-replay

A vulnerability has been identified in Mendix SAML Mendix 7 compatible All versions = V1.17.0 = V2.3.0 = V3.3.1 = V3.3.0 V3.3.4. Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option 'Allow Idp Initiated...