Log in Start free

Vulnerability · Published May 13, 2020 · Assigned by pivotal

CVE-2020-5407Signature Wrapping Vulnerability with spring-security-saml2-service-provider

High 8.8

In plain English

A high-severity security flaw in Spring Security from Spring by VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.2%top 31.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.springframework.security:spring-security-core5.2.4GHSA-48rw-j489-928m
Mavenorg.springframework.security:spring-security-core5.3.2GHSA-48rw-j489-928m

Affected products (as reported)

VendorProductVersions
Spring by VMware Spring Security 5.2 – before 5.2.45.3 – before 5.3.2

Weakness: CWE-347

References