Vulnerability in Drupal Saml Sp 2.0 Single Sign On
CVE-2022-26493
Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signature - impersonating existing users and existing roles, including administrative users/roles. This vulnerability is not mitigated by configuring the module to enforce signatures or certificate checks. Xecurify recommends updating miniOrange modules to their most recent versions. This vulnerability is present in paid versions of the miniOrange Drupal SAML SP product affecting Drupal 7, 8, and 9.
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (45.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Drupal Saml Sp 2.0 Single Sign On
- Xecuify Drupal 7 Miniorange Saml Sp — versions miniOrange Premium, miniOrange Standard, miniOrange Enterprise
- Xecuify Drupal 8 Miniorange Saml Sp — versions miniOrange Premium, miniOrange Standard, miniOrange Enterprise
- Xecuify Drupal 9 Miniorange Saml Sp — versions miniOrange Premium, miniOrange Standard, miniOrange Enterprise
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2022-26493?
- CVE-2022-26493 is a critical-severity vulnerability in Drupal Saml Sp 2.0 Single Sign On, classified under Improper Certificate Validation. CVSS score: 9.8/10. Published 2022-06-03.
- How severe is CVE-2022-26493?
- Critical severity. CVSS v3 base score is 9.8 out of 10.