Description

An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.

Remediation

References

https://www.whitehats.nl/blog/xml-signature-wrapping-samlify

https://github.com/tngan/samlify/releases/tag/v2.3.0

Related Vulnerabilities

CVE-2017-7561 Vulnerability in maven package org.jboss.resteasy:resteasy-jaxrs

CVE-2019-18608 Vulnerability in npm package cezerin

CVE-2020-4077 Vulnerability in maven package org.webjars.npm:electron

CVE-2022-39288 Vulnerability in npm package fastify

CVE-2016-10663 Vulnerability in npm package wixtoolset

Severity

High

Classification

CWE-91 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mitigation Third Party Advisory Issue Tracking Patch Release Notes