Unscored severity · published Sep 2, 2011
CVE-2011-1411
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensaml · Shibboleth
2.4.0; 2.4.1; 2.4.2; 2.5.0 · source: NVD
SH
Shibboleth-identity-provider · Shibboleth
through 2.3.1; 2.0.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1411
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1411
secunia.com
http://secunia.com/advisories/50994
Vendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20110725.txt
www.debian.org
http://www.debian.org/security/2011/dsa-2284
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
www.oracle.com
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
More from Opensaml
8.1
CVE-2017-16853
The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the…
–
CVE-2013-6440
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to…