Medium severity · published Apr 4, 2019
CVE-2014-3603
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server…
5.9
CVSS
0.8%
EPSS
No
On KEV
Description
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Identity Provider · Shibboleth
before 2.4.1 · source: NVD
OJ
Opensaml Java · Shibboleth
before 2.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3603
Permissions Required
http://secunia.com/advisories/60816
Vendor Advisory
http://shibboleth.net/community/advisories/secadv_20140813.txt
Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=1131823
More from Identity Provider
7.5
CVE-2020-27978
Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw
–
CVE-2015-1796
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are…