Skip to content
NewA calmer, faster ZeroHour
Vulnerability4 · 2 reads

CVE-2024-45409

CVSS 3.1
9.8 critical
EPSS
11%p96
Published
·
Modified
Analyze CVE-2024-45409 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.

Vendors
oneloginomniauthgitlab
Products
ruby-saml, omniauth saml, gitlab
Weakness
CWE-347
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (10.7%)

In the news

4 stories