CVE-2020-27978

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw

published October 28, 2020

CVSS
—
EPSS
2%
Percentile
79.0
In the wild
Unconfirmed
What it is

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01855 · 79.0th percentile
Published
2020-10-28T14:43Z
EPSS history
Timeline
  • 28 OCT 14:43Z
    Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw
    cvelistv5