CVE-2018-5387

EPSS 1.7%CWE-287

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 1.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

24 Jul 2018Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Affected products

Wizkunde · SAMLBase

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations https://github.com/GoGentoOSS/SAMLBase/commit/482cdf8c090e0f1179073034ebcb609ac7c3f5b3 https://github.com/GoGentoOSS/SAMLBase/issues/3 https://www.kb.cert.org/vuls/id/475445