ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.
References
Configurations
History
06 Mar 2025, 14:24
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | ||
| First Time |
Ssoready
Ssoready ssoready |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:ssoready:ssoready:*:*:*:*:*:*:*:* | |
| References | () https://github.com/ssoready/ssoready/security/advisories/GHSA-j2hr-q93x-gxvh - Vendor Advisory | |
| References | () https://github.com/ssoready/ssoready/commit/7f92a0630439972fcbefa8c7eafe8c144bd89915 - Patch | |
| References | () https://ssoready.com/docs/self-hosting/self-hosting-sso-ready - Product |
09 Oct 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-09 19:15
Updated : 2025-03-06 14:24
NVD link : CVE-2024-47832
Mitre link : CVE-2024-47832
JSON object : View
Products Affected
ssoready
- ssoready
CWE
No CWE.