CVE-2018-7644

The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote…

published March 5, 2018

CVSS
—
EPSS
1%
Percentile
69.0
In the wild
Unconfirmed
What it is

The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01249 · 69.0th percentile
Published
2018-03-05T14:00Z
EPSS history
Timeline
  • 05 MAR 14:00Z
    The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote…
    cvelistv5