525 matches found
CVE-2014-3552
The CVE-2014-3552 entry concerns Moodle’s Shibboleth authentication plugin (auth/shibboleth/index.php). It affects Moodle versions up to 2.3.11, 2.4.x prior to 2.4.11, and 2.5.x prior to 2.5.7, where the plugin fails to check for an empty session ID. This allows remote authenticated users to hija...
CVE-2014-3552
The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction...
CVE-2013-6440
The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...
CVE-2013-6440
The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...
CVE-2013-6440
Removed by vendor...
CVE-2012-4494
The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in...
Design/Logic Flaw
The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in...
CVE-2012-4494
The CVE-2012-4494 issue affects the Drupal Shibboleth authentication module (7.x-4.0). The vulnerability arises because the module does not properly verify the active status of users, allowing remote blocked users to bypass intended access restrictions by logging in. This is supported by multiple...
CVE-2012-4494
The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in...
SA-CONTRIB-2012-123 - Shibboleth authentication - Access Bypass
The Shibboleth authentication module provides user authentication with Shibboleth single sign-on systems both v1.3 and v2.0 as well as some authorization features automatic role assignment based on Shibboleth attributes. The module doesn't sufficiently confirm the user's active status in Drupal...
CVE-2011-1411
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...
CVE-2011-1411
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...
Authentication flaw
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...
CVE-2011-1411
CVE-2011-1411 affects Shibboleth OpenSAML libraries: OpenSAML 2.4.x before 2.4.3, 2.5.x before 2.5.1, and IdP before 2.3.2. The issue is an XML Signature Wrapping vulnerability allowing remote attackers to forge messages and bypass authentication. Practical impact described in sources is authenti...
CVE-2011-1411
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...
CVE-2011-1411
Removed by vendor...
Shibboleth / opensaml signature wrapping attacks
It's possible to spoof signed content...
Debian DSA-2284-1 : opensaml2 - implementation error
Juraj Somorovsky, Andreas Mayer, Meiko Jensen, Florian Kohlar, Marco Kampmann and Joerg Schwenk discovered that Shibboleth, a federated web single sign-on system is vulnerable to XML signature wrapping attacks. More details can be found in the Shibboleth advisory. %NASLMINLEVEL 70300 C Tenable...
opensaml2 -- unauthenticated login
OpenSAML developer reports: The Shibboleth software relies on the OpenSAML libraries to perform verification of signed XML messages such as attribute queries or SAML assertions. Both the Java and C++ versions are vulnerable to a so-called "wrapping attack" that allows a remote, unauthenticated...
