Vulnerability · Published Apr 26, 2021 · Assigned by snyk
CVE-2021-23365Authentication Bypass
Medium 4.8
In plain English
A medium-severity security flaw in github.com/TykTechnologies/tyk-identity-broker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)1.0%top 36.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/TykTechnologies/tyk-identity-broker | 1.1.1 | GO-2022-0906 |
| Go | github.com/tyktechnologies/tyk-identity-broker | 1.1.1 | GHSA-599h-8wpj-75xj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | github.com/TykTechnologies/tyk-identity-broker | unspecified – before 1.1.1 |
References
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKIDENTITYBROKER-1089720 x_refsource_MISC
- https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.1.1 x_refsource_MISC
- https://github.com/TykTechnologies/tyk-identity-broker/commit/243092965b0f93a95a14cb882b5b9a3df61dd5c0 x_refsource_MISC
- https://github.com/TykTechnologies/tyk-identity-broker/commit/46f70420e0911e4e8b638575e29d394c227c75d0 x_refsource_MISC
- https://github.com/TykTechnologies/tyk-identity-broker/pull/147 x_refsource_MISC