CVE-2024-25718
Critical
Description
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Dropbox Samly
PublishedFeb 11, 2024
First seenFeb 11, 2024
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- dropbox samly1.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dropbox samly | v < 1.4.0 | 1.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.