VulnerabilityModified
CVE-2020-12676
FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack".
CRITICAL 9.1EPSS 2.91%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack".
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 2.91% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-347
- Affected
- fusionauth/samlv2
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/159454/FusionAuth-SAMLv2-0.2.3-Message-Forging.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Oct/1Exploit, Mailing List, Third Party Advisory
- https://compass-security.com/fileadmin/Research/Advisories/2020-06_CSNC-2020-002_FusionAuth_Signature_Exclusion_Attack.txtExploit, Mailing List, Vendor Advisory
- https://github.com/SAMLRaider/SAMLRaiderThird Party Advisory
- https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdfExploit, Third Party Advisory
- http://packetstormsecurity.com/files/159454/FusionAuth-SAMLv2-0.2.3-Message-Forging.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Oct/1Exploit, Mailing List, Third Party Advisory
- https://compass-security.com/fileadmin/Research/Advisories/2020-06_CSNC-2020-002_FusionAuth_Signature_Exclusion_Attack.txtExploit, Mailing List, Vendor Advisory
- https://github.com/SAMLRaider/SAMLRaiderThird Party Advisory
- https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdfExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.