CVE-2015-1796

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no…

published July 8, 2015

CVSS
—
EPSS
1%
Percentile
69.1
In the wild
Unconfirmed
What it is

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01247 · 69.1th percentile
Published
2015-07-08T15:00Z
EPSS history
Timeline
  • 08 JUL 15:00Z
    The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no…
    cvelistv5