46 matches found
@skuhnow/directus (>=9.8.0 <=9.14.4) potentially affected by CVE-2022-39299 via node-saml (=4.0.0-beta.2)
node-saml NPM version =4.0.0-beta.2 is affected by a known vulnerability. The following packages have a transitive dependency on node-saml and may be impacted: - @skuhnow/directus =9.8.0, =9.14.4 Source cves: CVE-2022-39299 Source advisory: OSV:GHSA-M974-647V-WHV7...
CVE-2022-39299
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML elemen...
Authentication flaw
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML elemen...
CVE-2022-39299 Signature bypass via multiple root elements in Passport-SAML
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML elemen...
PT-2022-24881 · Unknown +1 · Passport-Saml +1
Name of the Vulnerable Software and Affected Versions: Passport-SAML versions prior to 3.2.2 node-saml versions prior to 4.0.0-beta.5 Description: A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in...
CVE-2022-39299 Signature bypass via multiple root elements in Passport-SAML
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML elemen...