CVE-2020-27847

Katalog CVE

CVSS 9.8 · Critical EPSS 1,7%

Kerentanan Improper Handling of Syntactically Invalid Structure pada linuxfoundation dex. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.

Rincian

Terbit di NVD

28 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-228: Improper Handling of Syntactically Invalid Structure

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ advisory vendor
• https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5 patch · advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=1907732 issue tracking · advisory pihak ketiga