PT-2015-6876
CVE-2015-5372
·
تاريخ النشر
2015-09-28
·
تاريخ التحديث
2018-10-09
الوصف من
CVSS 2.0
5.0
متوسطةالمقاييسAV:N/AC:L/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
AdNovum nevisAuth versions 4.13.0.0 through 4.18.3.0
Description
The issue concerns the SAML 2.0 implementation when using SAML POST-Binding. It does not properly match all attributes of the X.509 certificate embedded in the assertion against the certificate from the identity provider (IdP). This allows remote attackers to inject arbitrary SAML assertions via a crafted certificate.
Recommendations
For AdNovum nevisAuth versions 4.13.0.0 through 4.18.3.0, update to version 4.18.3.1 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾