Summary
Toni Huttunen and Fraktal Oy discovered that the Shibboleth Service
provider allowed content injection due to allowing attacker-controlled
parameters in error or other status pages. An attacker could use this to
inject malicious content.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | shibboleth-sp | 3.0.4+dfsg1-1ubuntu0.1 |
Vulnerabilities 1
-
Unscored —
Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled …
References
-
report
https://ubuntu.com/security/CVE-2021-28963