Skip to content
OpenAdvisories

Package · Maven

org.opensaml:opensaml

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.9
    CVE-2014-3603

    Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java

    The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fie…

    Shibboleth; OpenSAML Java OpenSAML Java Identity Provider (IdP) org.opensaml:opensaml Maven
  • Medium —
    CVE-2015-1796

    Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

    The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via …

    org.opensaml:opensaml edu.internet2.middleware:shibboleth-identityprovider Maven
  • Medium —
    CVE-2013-6440

    Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML

    The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks …

    org.opensaml:opensaml Maven
  • Medium —
    CVE-2011-1411

    Improper Authentication in OpenSAML

    Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

    org.opensaml:opensaml Maven