Vulnerability Details CVE-2021-39171
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 57.5%
CVSS Severity
CVSS v3 Score 5.3
CVSS v2 Score 5.0
References
Products affected by CVE-2021-39171
-
cpe:2.3:a:passport-saml_project:passport-saml:-
-
cpe:2.3:a:passport-saml_project:passport-saml:0.0.1
-
cpe:2.3:a:passport-saml_project:passport-saml:0.0.2
-
cpe:2.3:a:passport-saml_project:passport-saml:0.0.3
-
cpe:2.3:a:passport-saml_project:passport-saml:0.0.4
-
cpe:2.3:a:passport-saml_project:passport-saml:0.1.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.10.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.11.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.11.1
-
cpe:2.3:a:passport-saml_project:passport-saml:0.12.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.13.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.14.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.15.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.16.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.16.1
-
cpe:2.3:a:passport-saml_project:passport-saml:0.16.2
-
cpe:2.3:a:passport-saml_project:passport-saml:0.2.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.2.1
-
cpe:2.3:a:passport-saml_project:passport-saml:0.20.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.20.1
-
cpe:2.3:a:passport-saml_project:passport-saml:0.20.2
-
cpe:2.3:a:passport-saml_project:passport-saml:0.3.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.30.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.31.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.32.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.32.1
-
cpe:2.3:a:passport-saml_project:passport-saml:0.33.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.34.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.35.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.4.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.5.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.5.1
-
cpe:2.3:a:passport-saml_project:passport-saml:0.5.2
-
cpe:2.3:a:passport-saml_project:passport-saml:0.5.3
-
cpe:2.3:a:passport-saml_project:passport-saml:0.6.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.6.1
-
cpe:2.3:a:passport-saml_project:passport-saml:0.6.2
-
cpe:2.3:a:passport-saml_project:passport-saml:0.7.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.8.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.9.0
-
cpe:2.3:a:passport-saml_project:passport-saml:0.9.1
-
cpe:2.3:a:passport-saml_project:passport-saml:0.9.2
-
cpe:2.3:a:passport-saml_project:passport-saml:1.0.0
-
cpe:2.3:a:passport-saml_project:passport-saml:1.1.0
-
cpe:2.3:a:passport-saml_project:passport-saml:1.2.0
-
cpe:2.3:a:passport-saml_project:passport-saml:1.3.0
-
cpe:2.3:a:passport-saml_project:passport-saml:1.3.1
-
cpe:2.3:a:passport-saml_project:passport-saml:1.3.2
-
cpe:2.3:a:passport-saml_project:passport-saml:1.3.3
-
cpe:2.3:a:passport-saml_project:passport-saml:1.3.4
-
cpe:2.3:a:passport-saml_project:passport-saml:1.3.5
-
cpe:2.3:a:passport-saml_project:passport-saml:1.4.0
-
cpe:2.3:a:passport-saml_project:passport-saml:1.4.1
-
cpe:2.3:a:passport-saml_project:passport-saml:1.4.2
-
cpe:2.3:a:passport-saml_project:passport-saml:1.5.0
-
cpe:2.3:a:passport-saml_project:passport-saml:2.0.0
-
cpe:2.3:a:passport-saml_project:passport-saml:2.0.1
-
cpe:2.3:a:passport-saml_project:passport-saml:2.0.2
-
cpe:2.3:a:passport-saml_project:passport-saml:2.0.3
-
cpe:2.3:a:passport-saml_project:passport-saml:2.0.4
-
cpe:2.3:a:passport-saml_project:passport-saml:2.0.5
-
cpe:2.3:a:passport-saml_project:passport-saml:2.0.6
-
cpe:2.3:a:passport-saml_project:passport-saml:2.1.0
-
cpe:2.3:a:passport-saml_project:passport-saml:2.2.0
-
cpe:2.3:a:passport-saml_project:passport-saml:3.0.0