CVE-2020-3580

CVE-2020-3580 Отражённый XSS в Cisco ASA / FTD в конечной точке WebVPN SAML SP ACS /+CSCOE+/saml/sp/acs. Исправлен в cisco-sa-asaftd-xss-multiple-FCB3vPZe. Этот репозиторий содержит: xss.html — PoC, проверяемая человеком для авторизованных целей. src/ — конвейер обнаружения и проверки с учётом...

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

Summary SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login. If a saved SP state contains ExpectedIssuer = IdP A, but the ACS receives a valid response from IdP B, the code logs a warning and continues processing instead of rejecting the response. That...