CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2022-23505

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 17.1%

CVSS Severity

CVSS v3 Score 5.3

References

Products affected by CVE-2022-23505

Auth0 » Passport-Wsfed-Saml2 » Version: 1.0.1

cpe:2.3:a:auth0:passport-wsfed-saml2:1.0.1
Auth0 » Passport-Wsfed-Saml2 » Version: 1.1.0

cpe:2.3:a:auth0:passport-wsfed-saml2:1.1.0
Auth0 » Passport-Wsfed-Saml2 » Version: 1.2.0

cpe:2.3:a:auth0:passport-wsfed-saml2:1.2.0
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.0

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.0
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.1

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.1
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.2

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.2
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.4

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.4
Auth0 » Passport-Wsfed-Saml2 » Version: 1.3.5

cpe:2.3:a:auth0:passport-wsfed-saml2:1.3.5
Auth0 » Passport-Wsfed-Saml2 » Version: 2.0.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.0.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.0.1

cpe:2.3:a:auth0:passport-wsfed-saml2:2.0.1
Auth0 » Passport-Wsfed-Saml2 » Version: 2.0.2

cpe:2.3:a:auth0:passport-wsfed-saml2:2.0.2
Auth0 » Passport-Wsfed-Saml2 » Version: 2.1.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.1.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.1.1

cpe:2.3:a:auth0:passport-wsfed-saml2:2.1.1
Auth0 » Passport-Wsfed-Saml2 » Version: 2.10.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.10.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.1

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.1
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.2

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.2
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.3

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.3
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.5

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.5
Auth0 » Passport-Wsfed-Saml2 » Version: 2.11.6

cpe:2.3:a:auth0:passport-wsfed-saml2:2.11.6
Auth0 » Passport-Wsfed-Saml2 » Version: 2.12.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.12.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.13.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.13.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.3.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.3.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.4.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.4.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.5.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.5.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.5.1

cpe:2.3:a:auth0:passport-wsfed-saml2:2.5.1
Auth0 » Passport-Wsfed-Saml2 » Version: 2.6.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.6.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.7.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.7.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.8.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.8.0
Auth0 » Passport-Wsfed-Saml2 » Version: 2.9.0

cpe:2.3:a:auth0:passport-wsfed-saml2:2.9.0
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.0

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.0
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.1

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.1
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.10

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.10
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.11

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.11
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.12

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.12
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.14

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.14
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.15

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.15
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.16

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.16
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.17

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.17
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.2

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.2
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.3

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.3
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.4

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.4
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.5

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.5
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.6

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.6
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.7

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.7
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.8

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.8
Auth0 » Passport-Wsfed-Saml2 » Version: 3.0.9

cpe:2.3:a:auth0:passport-wsfed-saml2:3.0.9
Auth0 » Passport-Wsfed-Saml2 » Version: 4.0.0

cpe:2.3:a:auth0:passport-wsfed-saml2:4.0.0
Auth0 » Passport-Wsfed-Saml2 » Version: 4.0.1

cpe:2.3:a:auth0:passport-wsfed-saml2:4.0.1
Auth0 » Passport-Wsfed-Saml2 » Version: 4.1.0

cpe:2.3:a:auth0:passport-wsfed-saml2:4.1.0
Auth0 » Passport-Wsfed-Saml2 » Version: 4.2.0

cpe:2.3:a:auth0:passport-wsfed-saml2:4.2.0
Auth0 » Passport-Wsfed-Saml2 » Version: 4.3.0

cpe:2.3:a:auth0:passport-wsfed-saml2:4.3.0
Auth0 » Passport-Wsfed-Saml2 » Version: 4.4.0

cpe:2.3:a:auth0:passport-wsfed-saml2:4.4.0
Auth0 » Passport-Wsfed-Saml2 » Version: 4.5.0

cpe:2.3:a:auth0:passport-wsfed-saml2:4.5.0
Auth0 » Passport-Wsfed-Saml2 » Version: 4.5.1

cpe:2.3:a:auth0:passport-wsfed-saml2:4.5.1

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2022-23505

Products

Pricing

Contact Us