Description

An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.

Remediation

References

https://www.whitehats.nl/blog/xml-signature-wrapping-samlify

https://github.com/tngan/samlify/releases/tag/v2.3.0

Related Vulnerabilities

CVE-2016-10570 Vulnerability in npm package pngcrush-installer

CVE-2017-16670 Vulnerability in maven package com.smartbear.soapui:soapui-project

CVE-2023-31417 Vulnerability in maven package org.elasticsearch:elasticsearch

CVE-2021-43571 Vulnerability in npm package starkbank-ecdsa

CVE-2021-32855 Vulnerability in npm package vditor

Severity

High

Classification

CWE-91 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mitigation Third Party Advisory Issue Tracking Patch Release Notes