Vulnerabilities

TI-2023-22282 CVE-2023-41890 · GHSA-fv2h-753j-9g39

Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

MEDIUM 40

Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00752 Published 2023-09-19 Fixed in 1.0.3, 2.9.2 CWE-289

TI-2020-04324 CVE-2020-5268 · GHSA-9475-xg6m-j7pw

Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET

LOW 34

In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.01086 Published 2020-04-21 Fixed in 1.0.2, 2.7.0 CWE-303

TI-2020-04317 CVE-2020-5261 · GHSA-g6j2-ch25-5mmv

Missing Token Replay Detection

LOW 39

Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.01496 Published 2020-03-25 Fixed in 2.5.0 CWE-294

Vulnerabilities

Filters

Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET

Missing Token Replay Detection