node-saml@4.0.0-beta.0 vulnerabilities

SAML 2.0 Library

latest version

3.1.2

first published

4 years ago

latest version published

2 years ago

deprecated

Package is deprecated

licenses detected

MIT
>=0

View node-saml package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the node-saml package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Improper Verification of Cryptographic Signature node-saml is a SAML 2.0 Library Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature by allowing a remote attacker to bypass SAML authentication on a website using `passport-sam`l. Note A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. How to fix Improper Verification of Cryptographic Signature? A fix was pushed into the `master` branch but not yet published.	*
H Improper Verification of Cryptographic Signature node-saml is a SAML 2.0 Library Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature by allowing a remote attacker to bypass SAML authentication on a website using `passport-saml`. Note A successful attack requires that the attacker is in possession of an arbitrary IDP-signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g, without access to a valid user) might also be feasible if the generation of a signed message can be triggered. How to fix Improper Verification of Cryptographic Signature? A fix was pushed into the `master` branch but not yet published.	*

Improper Verification of Cryptographic Signature

node-saml is a SAML 2.0 Library

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature by allowing a remote attacker to bypass SAML authentication on a website using passport-saml.

Note A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.

How to fix Improper Verification of Cryptographic Signature?

A fix was pushed into the master branch but not yet published.

Improper Verification of Cryptographic Signature

node-saml is a SAML 2.0 Library

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature by allowing a remote attacker to bypass SAML authentication on a website using passport-saml.

Note A successful attack requires that the attacker is in possession of an arbitrary IDP-signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g, without access to a valid user) might also be feasible if the generation of a signed message can be triggered.

How to fix Improper Verification of Cryptographic Signature?

A fix was pushed into the master branch but not yet published.

Go back to all versions of this package