What is GHSA-vg4f-8v9q-5c3x?

GHSA-vg4f-8v9q-5c3x is a security advisory published by GitHub Security Advisories with High severity. LightSAML Incorrect Access Control vulnerability

Which CVE IDs does GHSA-vg4f-8v9q-5c3x cover?

GHSA-vg4f-8v9q-5c3x covers the following CVE IDs: CVE-2018-1000165. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vg4f-8v9q-5c3x?

GHSA-vg4f-8v9q-5c3x has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-vg4f-8v9q-5c3x?

GHSA-vg4f-8v9q-5c3x affects 1 product, including: composer/lightsaml/lightsaml:\u003c 1.3.5.

GHSA-vg4f-8v9q-5c3xHighCVSS 7.5

LightSAML Incorrect Access Control vulnerability

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

April 23, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000165 →

📋 Description

LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.

🎯 Affected products1

composer/lightsaml/lightsaml:< 1.3.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000165
https://github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a
https://github.com/lightSAML/lightSAML/releases/tag/1.3.5
https://github.com/advisories/GHSA-vg4f-8v9q-5c3x