CVE-2021-33054: High severity sogo by inverse vulnerability
Published Jun 4, 2021
·Updated
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
Affected Software
6 affected componentsFixes available
debian/sogo
4.0.7-1+deb10u25.0.1-4+deb11u15.8.0-15.8.4-1
Inverse SOGo>=2.0.6<2.4.1
Inverse SOGo>=3.0.0<5.1.1
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Event History
Jun 4, 2021
CVE Published
via MITRE·02:40 PM
Data Sourced
via MITRE·02:40 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-33054?
CVE-2021-33054 has a high severity rating as it allows unauthorized actors to impersonate users when SAML is used for authentication.
2
How do I fix CVE-2021-33054?
To fix CVE-2021-33054, upgrade SOGo to version 5.1.1 or later.
3
Which SOGo versions are affected by CVE-2021-33054?
CVE-2021-33054 affects SOGo versions prior to 5.1.1 and between 2.0.6 and 2.4.1.
4
Can network access lead to exploitation of CVE-2021-33054?
Yes, any actor with network access to the SOGo deployment can exploit CVE-2021-33054.
5
What type of vulnerability is CVE-2021-33054?
CVE-2021-33054 is a SAML assertion signature validation vulnerability.