Ubuntu.comUB:CVE-2017-11430CVE-2017-11430
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.011 Low
EPSS
Percentile
84.2%
OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the
results of XML DOM traversal and canonicalization APIs in such a way that
an attacker may be able to manipulate the SAML data without invalidating
the cryptographic signature, allowing the attack to potentially bypass
authentication to SAML service providers.
Notes
| Author | Note |
|---|---|
| msalvatore | Affected code is in ruby-saml |
References
duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
github.com/omniauth/omniauth-saml/issues/156
github.com/omniauth/omniauth-saml/pull/157
launchpad.net/bugs/cve/CVE-2017-11430
nvd.nist.gov/vuln/detail/CVE-2017-11430
security-tracker.debian.org/tracker/CVE-2017-11430
www.cve.org/CVERecord?id=CVE-2017-11430
www.kb.cert.org/vuls/id/475445
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.011 Low
EPSS
Percentile
84.2%