Shibboleth

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

Shibboleth records in CISA KEV

No Shibboleth vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Service Provider 7 records HIGH Identity Provider 3 records LOW Opensaml 3 records LOW Opensaml Java 2 records LOW Xmltooling-c 2 records LOW Oidc Op 1 record MEDIUM Shibboleth-identity-provider 1 record LOW Shibboleth-sp 1 record LOW

Records

7 records in Service Provider · all components

TI-2023-09078 CVE-2023-22947 · GHSA-fc86-55vx-x268

Insecure folder permissions in the Windows installation path of Shibboleth Service…

HIGH 67

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executab…

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00318 Published 2023-01-11 No fix listed CWE-427

TI-2021-11820 CVE-2021-31826 · GHSA-rqpx-m7mv-mxxf

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw…

LOW 37

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02 Published 2021-04-27 No fix listed CWE-476

TI-2017-12399 CVE-2017-16852 · GHSA-5rhm-55rh-pvvp

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in…

LOW 37

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform criti…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01105 Published 2017-11-16 No fix listed CWE-347

TI-2019-13825 CVE-2019-19191 · GHSA-gcm7-32c7-5wrq

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on…

LOW 35

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00499 Published 2019-11-21 No fix listed CWE-59

TI-2010-02353 CVE-2010-2450 · GHSA-9cvv-j545-66mj

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by…

LOW 35

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.012 Published 2019-11-07 No fix listed CWE-200

TI-2021-09888 CVE-2021-28963 · GHSA-6jjj-9g6r-j2vh

Shibboleth Service Provider before 3.2.1 allows content injection because template…

LOW 27

Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01305 Published 2021-03-22 No fix listed CWE-74

TI-2015-02369 CVE-2015-2684 · GHSA-44gq-2834-6749

Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause…

LOW 23

Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.01936 Published 2015-03-31 No fix listed CWE-20

Open these records in search →

Critical	1
High	9
Medium	10
Low	0
No CVSS	0