Lucene search
Veracode Vulnerability DatabaseVERACODE:25056HistoryApr 22, 2020 - 5:43 a.m.
Authorization Bypass
2020-04-2205:43:30
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
9
0.001 Low
EPSS
Percentile
48.3%
sustainsys.saml2 is vulnerable to authorization bypass. The vulnerability exists as it recognizes all incoming tokens as bearer tokens. A user would not require a valid Saml2 bearer token to create a log in session.
| CPE | Name | Operator | Version |
|---|---|---|---|
| sustainsys.saml2 | le | 1.0.1 | |
| sustainsys.saml2 | le | 2.4.0 |
References
github.com/Sustainsys/Saml2/commit/2ebbdba792e8d66218de91e899f0f785eed670d0
github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241
github.com/Sustainsys/Saml2/issues/1107
github.com/Sustainsys/Saml2/issues/711
github.com/Sustainsys/Saml2/issues/712
github.com/Sustainsys/Saml2/security/advisories/GHSA-9475-xg6m-j7pw
www.nuget.org/packages/Sustainsys.Saml2/
Related
nvd
nvd
CVE-2020-5268
2020-04-21 17:15:13
osv
osv
Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET
2020-04-22 20:59:37
CVE-2020-5268
2020-04-21 17:15:13
cvelist
cvelist
cve
cve
CVE-2020-5268
2020-04-21 17:15:13
github
github
prion
prion
Session fixation
2020-04-21 17:15:00
