Auth bypass in Eduserv Openathens Service Provider

CVE-2012-5353

Eduserv OpenAthens SP 2.0 for Java allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."

Vulnerability class: Broken Authentication

EPSS: 0.022 (80.3th percentile) — read the EPSS interpretation.

Affected products

Eduserv Openathens_service_provider — versions 2.0
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (x_refsource_MISC)