CVE-2017-16897
First published: Wed Dec 27 2017(Updated: )
A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Auth0 passport-wsfed-saml2 | <3.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/severity
- agent/author
- agent/event
- vendor/auth0
- canonical/auth0 passport-wsfed-saml2