Vulnerability in Drupal Saml Sp 2.0 Single Sign On
CVE-2022-26493
Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signature - impersonating existing users and existing roles, including administrative users/roles. This vulnerability is not mitigated by configuring the module to enforce signatures or certificate checks. Xecurify recommends updating miniOrange modules to their most recent versions. This vulnerability is present in paid versions of the miniOrange Drupal SAML SP product affecting Drupal 7, 8, and 9.
Vulnerability class: Improper Certificate Validation
EPSS: 0.006 (43.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Drupal Saml_sp_2.0_single_sign_on
- Xecuify Drupal 7 Miniorange Saml Sp — versions miniOrange Premium, miniOrange Standard, miniOrange Enterprise
- Xecuify Drupal 8 Miniorange Saml Sp — versions miniOrange Premium, miniOrange Standard, miniOrange Enterprise
- Xecuify Drupal 9 Miniorange Saml Sp — versions miniOrange Premium, miniOrange Standard, miniOrange Enterprise
Weakness classification (CWE)
References
- mlhess@drupal.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-26493?
- CVE-2022-26493 is a critical-severity vulnerability in Drupal Saml Sp 2.0 Single Sign On, classified under Improper Certificate Validation. CVSS score: 9.8/10. Published 2022-06-03.
- How severe is CVE-2022-26493?
- Critical severity. CVSS v3 base score is 9.8 out of 10.