CVE-2017-16897
High
Description
A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).
SeverityHigh
CVSS8.1
Exploit probability—
Product
Auth0 Passport-wsfed-saml2
PublishedDec 27, 2017
First seenDec 27, 2017
How to fix
Update
- auth0 passport-wsfed-saml23.0.5 or later
- passport-wsfed-saml23.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| auth0 passport-wsfed-saml2 | v < 3.0.5 | 3.0.5 |
| passport-wsfed-saml2npm | v < 3.0.5 | 3.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.