CVE-2021-33054

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives

published June 4, 2021

CVSS
—
EPSS
1%
Percentile
62.4
In the wild
Unconfirmed
What it is

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00995 · 62.4th percentile
Published
2021-06-04T14:40Z
EPSS history
Timeline
  • 04 JUN 14:40Z
    SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives
    cvelistv5