GHSA-vg4f-8v9q-5c3x

LightSAML Incorrect Access Control vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000165

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	lightsaml/lightsaml	< 1.3.5	1.3.5

Details

As written in the advisory (Markdown source, shown as plain text).

LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in `src/LightSaml/Model/XmlDSig/` that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000165 advisory
https://github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a web
https://github.com/lightSAML/lightSAML package
https://github.com/lightSAML/lightSAML/releases/tag/1.3.5 web