Shibboleth
Shibboleth Service Provider: vulnerabilidades y CVE
Shibboleth Service Provider tiene 8 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE8
Últimos 12 meses0
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-9943 | Crítica (9.1) | 0.40% | — | 10 sept 2025 | An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An… |
| CVE-2023-22947 | Alta (7.3) | 0.31% | — | 11 ene 2023 | Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service… |
| CVE-2021-31826 | Alta (7.5) | 2.0% | — | 27 abr 2021 | Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a… |
| CVE-2021-28963 | Media (5.3) | 1.3% | — | 22 mar 2021 | Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters. |
| CVE-2019-19191 | Alta (7.8) | 0.48% | — | 21 nov 2019 | Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to… |
| CVE-2010-2450 | Alta (7.5) | 1.2% | — | 7 nov 2019 | The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of… |
| CVE-2017-16852 | Alta (8.1) | 1.1% | — | 16 nov 2017 | shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform… |
| CVE-2015-2684 | Media (4) | 1.9% | — | 31 mar 2015 | Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.