Skip to content
OpenAdvisories

Package · NuGet

Sustainsys.Saml2

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2023-41890

    Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

    Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. Th…

    Sustainsys Saml2 Sustainsys.Saml2 Kentor.AuthServices NuGet
  • Medium 6.5
    CVE-2020-5268

    Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET

    In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to …

    Sustainsys Saml2 Sustainsys.Saml2 NuGet
  • High 8.2
    CVE-2020-5261

    Missing Token Replay Detection

    Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign O…

    Sustainsys Saml2 Sustainsys.Saml2 NuGet