CVE-2025-40934
An attacker can remove the signature from the XML document to make it pass the verification check.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
- CVSS 3.1
- 9.3 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
- EPSS
- 0.16% probability · 6th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-347
- Affected
- xml\/\
- Source
- 9b29abf9-4ab0-4765-b253-1875cd9b441e
References
- https://github.com/perl-net-saml2/perl-XML-Sig/issues/63Issue Tracking, Patch
- https://github.com/perl-net-saml2/perl-XML-Sig/pull/64Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.