Vulnerabilities

TI-2023-24482 CVE-2023-45683 · GHSA-267v-3v32-g6q5

Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml

LOW 32

github.com/crewjam/saml is a saml library for the go language.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00485 Published 2023-10-16 Fixed in 0.4.14 CWE-79

TI-2023-12698 CVE-2023-28119 · GHSA-5mqj-xc49-246p

crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb

MEDIUM 41

The crewjam/saml go library contains a partial implementation of the SAML standard in golang.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00957 Published 2023-03-22 Fixed in 0.4.13 CWE-770

TI-2022-20253 CVE-2022-41912 · GHSA-j2jp-wvqg-wc2g

crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

MEDIUM 53

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02337 Published 2022-11-28 Partial fix · 0.4.9 CWE-287

TI-2020-16916 CVE-2020-27846 · GHSA-4hq8-gmxx-h6w9

Improper authentication in crewjam/saml

MEDIUM 50

A signature verification vulnerability exists in crewjam/saml.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04931 Published 2020-12-21 Partial fix · 0.4.3 CWE-115

Vulnerabilities

Filters

Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml

crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb

crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

Improper authentication in crewjam/saml