CVE-2011-1411

EUVD-2022-5052
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 51%
Affected Products (NVD)
VendorProductVersion
shibbolethopensaml
2.4.0
shibbolethopensaml
2.4.1
shibbolethopensaml
2.4.2
shibbolethopensaml
2.5.0
shibbolethshibboleth-identity-provider
𝑥
≤ 2.3.1
shibbolethshibboleth-identity-provider
2.0.0
shibbolethshibboleth-identity-provider
2.1.0
shibbolethshibboleth-identity-provider
2.1.1
shibbolethshibboleth-identity-provider
2.1.2
shibbolethshibboleth-identity-provider
2.1.3
shibbolethshibboleth-identity-provider
2.1.4
shibbolethshibboleth-identity-provider
2.1.5
shibbolethshibboleth-identity-provider
2.2.0
shibbolethshibboleth-identity-provider
2.2.1
shibbolethshibboleth-identity-provider
2.3.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
opensaml
hardy
ignored
lucid
dne
maverick
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
opensaml2
hardy
dne
lucid
Fixed 2.3-1ubuntu0.1
released
maverick
Fixed 2.3-2+squeeze1build0.10.10.1
released
natty
ignored
oneiric
not-affected
precise
not-affected
quantal
not-affected
Common Weakness Enumeration
References
http://secunia.com/advisories/50994
http://shibboleth.internet2.edu/secadv/secadv_20110725.txt
http://www.debian.org/security/2011/dsa-2284
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
http://secunia.com/advisories/50994
http://shibboleth.internet2.edu/secadv/secadv_20110725.txt
http://www.debian.org/security/2011/dsa-2284
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html