Medium severity · published Feb 27, 2018
CVE-2018-0489
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows…
6.5
CVSS
2.1%
EPSS
No
On KEV
Description
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Clearpass · Arubanetworks
6.6.0 through 6.6.9; 6.7.0 before 6.7.2 · source: NVD
DL
Debian Linux · Debian
7.0; 8.0; 9.0 · source: NVD
XM
Xmltooling-c · Shibboleth
before 1.6.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-0489
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-0489
Third Party Advisory
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt
Third Party Advisory
http://www.securityfocus.com/bid/103172
Third Party Advisory
http://www.securitytracker.com/id/1040435
Issue Tracking
https://lists.debian.org/debian-lts-announce/2018/02/msg00031.html
Patch
https://shibboleth.net/community/advisories/secadv_20180227.txt
Third Party Advisory
https://www.debian.org/security/2018/dsa-4126
More from Clearpass
9.8
CVE-2021-29145
A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1
9.8
CVE-2020-7114
A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to certain databases in ClearPass by…
9.8
CVE-2016-4401
Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials
9.8
CVE-2016-2034
SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0
8.8
CVE-2021-29147
A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5, 6.8.9, 6.7.14-HF1