CVE-2015-5372

The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of the X.509 certificate…

published September 28, 2015

CVSS
—
EPSS
1%
Percentile
58.2
In the wild
Unconfirmed
What it is

The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of the X.509 certificate embedded in the assertion against the certificate from the identity provider (IdP), which allows remote attackers to inject arbitrary SAML assertions via a crafted certificate.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00871 · 58.2th percentile
Published
2015-09-28T16:00Z
EPSS history
Timeline
  • 28 SEP 16:00Z
    The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of the X.509 certificate…
    cvelistv5