CVE-2017-1000433

—

CVSS 3.1

8.1 high

EPSS

3%p84

Published

Jan 2, 2018 (Jan 2, 2018)

Modified

Jun 17, 2026

Description

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.

Vendors: pysaml2 project debian
Products: pysaml2, debian linux
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.