CVE-2022-39300
Description
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
How to fix
- node_saml_project node_saml4.0.0 or later
- node-saml4.0.0-beta.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| node_saml_project node_saml | v < 4.0.0, 4.0.0 | 4.0.0 |
| node-samlnpm | v < 4.0.0-beta.5 | 4.0.0-beta.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.