Lucene search

MitreCVE-2020-27978

HistoryOct 28, 2020 - 3:15 p.m.

CVE-2020-27978

2020-10-2815:15:13

CWE-770

mitre

web.nvd.nist.gov

cve-2020-27978

shibboleth identify provider

denial of service

nvd

security flaw

java heap exhaustion

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

58.8%

JSON

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session.

Affected configurations

Nvd

Node

shibbolethidentity_providerRange3.0.0–3.4.6

VendorProductVersionCPE
shibbolethidentity_provider*cpe:2.3:a:shibboleth:identity_provider:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
shibboleth	identity_provider	*	cpe:2.3:a:shibboleth:identity_provider::::::::

References

shibboleth.net/community/advisories/secadv_20191002.txt

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

58.8%

JSON

Related for CVE-2020-27978