Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cvelistDrupalCVELIST:CVE-2022-26493
HistoryJun 03, 2022 - 4:00 p.m.

CVE-2022-26493 miniOrange SAML Authentication Bypass

2022-06-0316:00:14
drupal
www.cve.org
2
cve-2022-26493
miniorange saml
authentication bypass
xecurify drupal saml sp
vulnerability
drupal 7
drupal 8
drupal 9

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Xecurify’s miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signature - impersonating existing users and existing roles, including administrative users/roles. This vulnerability is not mitigated by configuring the module to enforce signatures or certificate checks. Xecurify recommends updating miniOrange modules to their most recent versions. This vulnerability is present in paid versions of the miniOrange Drupal SAML SP product affecting Drupal 7, 8, and 9.

CNA Affected

[
  {
    "product": "Drupal 8 miniOrange SAML SP",
    "vendor": "Xecuify",
    "versions": [
      {
        "lessThan": "30.5",
        "status": "affected",
        "version": "miniOrange Premium",
        "versionType": "custom"
      },
      {
        "lessThan": "20.3",
        "status": "affected",
        "version": "miniOrange Standard",
        "versionType": "custom"
      },
      {
        "lessThan": "40.4",
        "status": "affected",
        "version": "miniOrange Enterprise",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Drupal 9 miniOrange SAML SP",
    "vendor": "Xecuify",
    "versions": [
      {
        "lessThan": "30.5",
        "status": "affected",
        "version": "miniOrange Premium",
        "versionType": "custom"
      },
      {
        "lessThan": "20.3",
        "status": "affected",
        "version": "miniOrange Standard",
        "versionType": "custom"
      },
      {
        "lessThan": "40.4",
        "status": "affected",
        "version": "miniOrange Enterprise",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Drupal 7 miniOrange SAML SP",
    "vendor": "Xecuify",
    "versions": [
      {
        "lessThan": "30.2",
        "status": "affected",
        "version": "miniOrange Premium",
        "versionType": "custom"
      },
      {
        "lessThan": "20.2",
        "status": "affected",
        "version": "miniOrange Standard",
        "versionType": "custom"
      },
      {
        "lessThan": "40.2",
        "status": "affected",
        "version": "miniOrange Enterprise",
        "versionType": "custom"
      }
    ]
  }
]

Related

veracode 1
prion 1
cve 1
nvd 1
alpinelinux 1
veracode
veracode
Authorization Bypass
2022-07-26 03:27:29
prion
prion
Authorization
2022-06-03 18:15:00
cve
cve
CVE-2022-26493
2022-06-03 18:15:09
nvd
nvd
CVE-2022-26493
2022-06-03 18:15:09
alpinelinux
alpinelinux
CVE-2022-26493
2022-06-03 18:15:09

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON
Related for CVELIST:CVE-2022-26493
veracode1prion1cve1nvd1alpinelinux1