Shibboleth Service Provider
7 CVEs affecting Shibboleth Service Provider. Latest disclosed: 2023-01-11. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16852 | High | 8.1 | 2017-11-16 | shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itse… |
CVE-2019-19191 | High | 7.8 | 2019-11-21 | Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd accoun… |
CVE-2021-31826 | High | 7.5 | 2021-04-27 | Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a… |
CVE-2010-2450 | High | 7.5 | 2019-11-07 | The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key… |
CVE-2023-22947 | High | 7.3 | 2023-01-11 | Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate… |
CVE-2021-28963 | Medium | 5.3 | 2021-03-22 | Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters. |
CVE-2015-2684 | | 2015-03-31 | Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message. |