What is CVE-2015-1796?

CVE-2015-1796 is a vulnerability in Shibboleth Identity Provider, classified under CWE-254. Published 2015-07-08.

Is CVE-2015-1796 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Shibboleth Identity Provider

CVE-2015-1796

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.

EPSS: 0.013 (66.5th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

CWE-254

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2015-1796?: CVE-2015-1796 is a vulnerability in Shibboleth Identity Provider, classified under CWE-254. Published 2015-07-08.
Is CVE-2015-1796 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.