Vulnerabilities

TI-2023-09078 CVE-2023-22947 · GHSA-fc86-55vx-x268

Insecure folder permissions in the Windows installation path of Shibboleth Service…

HIGH 67

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executab…

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00318 Published 2023-01-11 No fix listed CWE-427

TI-2021-11820 CVE-2021-31826 · GHSA-rqpx-m7mv-mxxf

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw…

LOW 37

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02 Published 2021-04-27 No fix listed CWE-476

TI-2021-09888 CVE-2021-28963 · GHSA-6jjj-9g6r-j2vh

Shibboleth Service Provider before 3.2.1 allows content injection because template…

LOW 27

Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01305 Published 2021-03-22 No fix listed CWE-74

TI-2019-13825 CVE-2019-19191 · GHSA-gcm7-32c7-5wrq

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on…

LOW 35

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00499 Published 2019-11-21 No fix listed CWE-59

TI-2010-02353 CVE-2010-2450 · GHSA-9cvv-j545-66mj

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by…

LOW 35

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.012 Published 2019-11-07 No fix listed CWE-200

TI-2017-12399 CVE-2017-16852 · GHSA-5rhm-55rh-pvvp

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in…

LOW 37

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform criti…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01105 Published 2017-11-16 No fix listed CWE-347

TI-2015-02369 CVE-2015-2684 · GHSA-44gq-2834-6749

Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause…

LOW 23

Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.01936 Published 2015-03-31 No fix listed CWE-20