PT-2012-5948
CVE-2012-5353
·
تاريخ النشر
2012-10-09
·
تاريخ التحديث
2014-04-22
الوصف من
CVSS 2.0
5.8
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions
Eduserv OpenAthens SP version 2.0 for Java
Description
The issue allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, also known as a "Signature exclusion attack".
Recommendations
For Eduserv OpenAthens SP version 2.0 for Java, consider implementing proper validation of SAML assertions to ensure they contain a valid Signature element before processing them. As a temporary workaround, restrict access to sensitive resources that rely on SAML-based authentication until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾