fusionauth-samlv2

fusionauth-samlv2 这个仓库是使用JAXB在Java中实现的SAML v2.0绑定。 你可以使用这个库来处理SAML请求和响应。有关示例代码，请参阅测试。 安全披露 如果您发现漏洞或其他与安全相关的错误，请在打开GitHub问题之前在此处报告漏洞。这将使我们能够在公开披露之前评估披露内容并准备修复。 我们非常有兴趣奖励任何能够发现与安全相关的错误或漏洞并向我们适当披露的人。 披露 CSNC-2021-004 XML 外部实体 感谢 Compass Security 负责任地披露此问题。 参见 CVE-2021-27736 参见 CSNC-2021-004 影响 0.5.4...

SAML Implementation Vulnerability Impacting Some Akamai Services

This blog post provides an overview of a vulnerability discovered in Akamai's Enterprise Application Access EAA product which has been patched. This vulnerability could have allowed an actor to impersonate an authorized user when interacting with an application that used Security Assertion Markup...

FusionAuth fusionauth-samlv2 代码问题漏洞

fusionauth fusionauth-samlv2 is a personal developer of a JAVA library that provides JAXB functionality . The library can mainly handle SAML requests and replies for scenarios such as single sign-on. A security vulnerability exists in FusionAuth fusionauth-samlv2 versions prior to 0.5.4 that allo...

Authentication flaw

FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack"...

CVE-2020-12676

FusionAuth fusionauth-samlv2 0.2.3 is vulnerable to a Signature Exclusion Attack: remote attackers can forge SAML messages and bypass authentication when a SAML assertion lacks a Signature element. The Red Hat/Red Hat advisory and other connected sources confirm the affected version and behavior....

CVE-2020-12676

FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack"...

FusionAuth-SAMLv2 0.2.3 Message Forging

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: SAML v2.0 bindings in Java using JAXB Vendor: FusionAuth CSNC ID: CSNC-2020-002 CVE ID: CVE-2020-12676 Subject: Signature Exclusion Attack Risk: High Effect: Remotely exploitable Author: Felix Sieges Date:...