CVE-2020-5261

Katalog CVE

CVSS 6.8 · Medium EPSS 1,5%

Kerentanan Authentication Bypass by Capture-replay pada sustainsys saml2. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use.

Rincian

Terbit di NVD

25 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241 patch · advisory pihak ketiga
• https://github.com/Sustainsys/Saml2/issues/711 issue tracking · advisory pihak ketiga
• https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv advisory pihak ketiga