CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).

Exploit prediction scoring system (EPSS) score

EPSS Score 0.004

EPSS Ranking 61.3%

CVSS Severity

CVSS v3 Score 8.1

CVSS v2 Score 9.3

References

Products affected by CVE-2017-16897

Auth0 » Passport-Wsfed-Saml2 » Version: 1.0.1

cpe:2.3:a:auth0:passport-wsfed-saml2:1.0.1
Auth0 » Passport-Wsfed-Saml2 » Version: 1.1.0

cpe:2.3:a:auth0:passport-wsfed-saml2:1.1.0
Auth0 » Passport-Wsfed-Saml2 » Version: 1.2.0

cpe:2.3:a:auth0:passport-wsfed-saml2:1.2.0
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.0

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.0
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.1

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.1
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.2

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.2
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.4

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.4
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.5

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.5
Auth0 » Passport-Wsfed-Saml2 » Version: 2.0.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.0.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.0.1

cpe:2.3:a:auth0:passport-wsfed-saml2:2.0.1
Auth0 » Passport-Wsfed-Saml2 » Version: 2.0.2

cpe:2.3:a:auth0:passport-wsfed-saml2:2.0.2
Auth0 » Passport-Wsfed-Saml2 » Version: 2.1.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.1.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.1.1

cpe:2.3:a:auth0:passport-wsfed-saml2:2.1.1
Auth0 » Passport-Wsfed-Saml2 » Version: 2.10.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.10.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.1

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.1
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.2

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.2
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.3

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.3
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.5

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.5
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.6

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.6
Auth0 » Passport-Wsfed-Saml2 » Version: 2.12.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.12.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.13.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.13.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.3.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.3.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.4.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.4.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.5.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.5.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.5.1

cpe:2.3:a:auth0:passport-wsfed-saml2:2.5.1
Auth0 » Passport-Wsfed-Saml2 » Version: 2.6.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.6.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.7.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.7.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.8.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.8.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.9.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.9.0
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.0

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.0
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.1

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.1
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.2

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.2
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.3

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.3
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.4

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.4

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-16897

Products

Pricing

Contact Us