Read the docs

Shibboleth

Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

Shibboleth records in CISA KEV

No Shibboleth vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Service Provider 7 records HIGH Identity Provider 3 records LOW Opensaml 3 records LOW Opensaml Java 2 records LOW Xmltooling-c 2 records LOW Oidc Op 1 record MEDIUM Shibboleth-identity-provider 1 record LOW Shibboleth-sp 1 record LOW

Records

2 records in Opensaml Java · all components

TI-2014-02926 CVE-2014-3603 · GHSA-rm7v-gqfg-p2wc

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth…

Priority LOW 28

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.00844 Published 2019-04-04 Partial fix · 2.4.1, 2.6.2 CWE-297
TI-2015-01614 CVE-2015-1796 · GHSA-78fq-w796-q537

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java…

Priority LOW 23

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01247 Published 2015-07-08 Partial fix · 2.6.5, 2.4.4 CWE-254
Open these records in search →