Vulnerabilites related to passport-saml_project - passport-saml
cve-2021-39171
Vulnerability from cvelistv5
Published
2021-08-27 22:05
Modified
2024-08-04 01:58
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
References
https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2x_refsource_CONFIRM
https://github.com/node-saml/passport-saml/pull/595x_refsource_MISC
Impacted products
Vendor Product Version
node-saml passport-saml Version: < 3.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:58:18.150Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/node-saml/passport-saml/pull/595",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "passport-saml",
               vendor: "node-saml",
               versions: [
                  {
                     status: "affected",
                     version: "< 3.1.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400: Uncontrolled Resource Consumption",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-08-27T22:05:11",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/node-saml/passport-saml/pull/595",
            },
         ],
         source: {
            advisory: "GHSA-5379-r78w-42h2",
            discovery: "UNKNOWN",
         },
         title: "Unlimited transforms allowed for signed nodes",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-39171",
               STATE: "PUBLIC",
               TITLE: "Unlimited transforms allowed for signed nodes",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "passport-saml",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 3.1.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "node-saml",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-400: Uncontrolled Resource Consumption",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2",
                     refsource: "CONFIRM",
                     url: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2",
                  },
                  {
                     name: "https://github.com/node-saml/passport-saml/pull/595",
                     refsource: "MISC",
                     url: "https://github.com/node-saml/passport-saml/pull/595",
                  },
               ],
            },
            source: {
               advisory: "GHSA-5379-r78w-42h2",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-39171",
      datePublished: "2021-08-27T22:05:11",
      dateReserved: "2021-08-16T00:00:00",
      dateUpdated: "2024-08-04T01:58:18.150Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-39299
Vulnerability from cvelistv5
Published
2022-10-12 00:00
Modified
2024-08-03 12:00
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
References
https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7
https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e
http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html
Impacted products
Vendor Product Version
node-saml passport-saml Version: < 3.2.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:00:44.015Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "passport-saml",
               vendor: "node-saml",
               versions: [
                  {
                     status: "affected",
                     version: "< 3.2.2",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-347",
                     description: "CWE-347: Improper Verification of Cryptographic Signature",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-11-14T00:00:00",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7",
            },
            {
               url: "https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e",
            },
            {
               url: "http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html",
            },
         ],
         source: {
            advisory: "GHSA-m974-647v-whv7",
            discovery: "UNKNOWN",
         },
         title: "Signature bypass via multiple root elements in Passport-SAML",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2022-39299",
      datePublished: "2022-10-12T00:00:00",
      dateReserved: "2022-09-02T00:00:00",
      dateUpdated: "2024-08-03T12:00:44.015Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Vulnerability from fkie_nvd
Published
2022-10-12 21:15
Modified
2024-11-21 07:17
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
References
security-advisories@github.comhttp://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.htmlThird Party Advisory, VDB Entry
security-advisories@github.comhttps://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155ePatch, Third Party Advisory
security-advisories@github.comhttps://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.htmlThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155ePatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7Third Party Advisory
Impacted products
Vendor Product Version
passport-saml_project passport-saml *
passport-saml_project passport-saml 4.0.0
passport-saml_project passport-saml 4.0.0
passport-saml_project passport-saml 4.0.0
passport-saml_project passport-saml 4.0.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:passport-saml_project:passport-saml:*:*:*:*:*:node.js:*:*",
                     matchCriteriaId: "680B07BB-E2C0-4DD8-8C49-256652B31CAF",
                     versionEndExcluding: "3.2.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta1:*:*:*:node.js:*:*",
                     matchCriteriaId: "975F4B3F-A8E6-4241-ACBB-196E069D8852",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta2:*:*:*:node.js:*:*",
                     matchCriteriaId: "03328340-AE1A-4E9B-94A6-A377B1947176",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta3:*:*:*:node.js:*:*",
                     matchCriteriaId: "18EB32E2-7824-4A22-A58A-6DEEAB02E3AD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta4:*:*:*:node.js:*:*",
                     matchCriteriaId: "DF4C6124-FB33-4682-B68E-2D0341DB3B81",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.",
      },
      {
         lang: "es",
         value: "Passport-SAML es un proveedor de autenticación SAML versión 2.0 para Passport, la biblioteca de autenticación de Node.js. Un atacante remoto puede ser capaz de omitir la autenticación SAML en un sitio web usando passport-saml. Un ataque con éxito requiere que el atacante esté en posesión de un elemento XML firmado por un IDP arbitrario. Dependiendo del IDP usado, también podrían ser factibles los ataques sin autenticación (por ejemplo, sin acceso a un usuario válido) si puede activarse la generación de un mensaje firmado. Los usuarios deben actualizar a versión 3.2.2 de passport-saml o más reciente. El problema también estaba presente en las versiones beta de \"node-saml\" versiones anteriores a 4.0.0-beta.5. Si no puede actualizarse, puede deshabilitarse la autenticación SAML como mitigación",
      },
   ],
   id: "CVE-2022-39299",
   lastModified: "2024-11-21T07:17:59.113",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.4,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 5.2,
            source: "security-advisories@github.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-10-12T21:15:09.673",
   references: [
      {
         source: "security-advisories@github.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7",
      },
   ],
   sourceIdentifier: "security-advisories@github.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-347",
            },
         ],
         source: "security-advisories@github.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-347",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-08-27 22:15
Modified
2024-11-21 06:18
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.
References
security-advisories@github.comhttps://github.com/node-saml/passport-saml/pull/595Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/node-saml/passport-saml/pull/595Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2Third Party Advisory
Impacted products
Vendor Product Version
passport-saml_project passport-saml *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:passport-saml_project:passport-saml:*:*:*:*:*:node.js:*:*",
                     matchCriteriaId: "C05B72FD-D09E-4D1F-AE7C-F3E101B60045",
                     versionEndExcluding: "3.1.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.",
      },
      {
         lang: "es",
         value: "Passport-SAML es un proveedor de autenticación SAML versión 2.0 para Passport, la biblioteca de autenticación de Node.js. Anterior a la versión 3.1.0, una carga útil SAML maliciosa puede requerir transformaciones que consumen recursos significativos del sistema para procesar, y por lo tanto, resultando en un servicio reducido o denegado. Esta sería una manera efectiva de llevar a cabo un ataque de denegación de servicio. Esto ha sido resuelto en versión 3.1.0. La resolución consiste en limitar el número de transformaciones permitidas a 2.",
      },
   ],
   id: "CVE-2021-39171",
   lastModified: "2024-11-21T06:18:47.097",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 1.4,
            source: "security-advisories@github.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-08-27T22:15:07.267",
   references: [
      {
         source: "security-advisories@github.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/node-saml/passport-saml/pull/595",
      },
      {
         source: "security-advisories@github.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/node-saml/passport-saml/pull/595",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2",
      },
   ],
   sourceIdentifier: "security-advisories@github.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "security-advisories@github.com",
         type: "Primary",
      },
   ],
}