CVE-2021-3196

Katalog CVE

CVSS 8.8 · High EPSS 0,96%

Kerentanan Improper Verification of Cryptographic Signature pada hitachi id bravura security fabric. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0. When using federated identity management (authenticating via SAML through a third-party identity provider), an attacker can inject additional data into a signed SAML response being transmitted to the service provider (ID Bravura Security Fabric). The application successfully validates the signed values but uses the unsigned malicious values. An attacker with lower-privilege access to the application can inject the username of a high-privilege user to impersonate that user.

Rincian

Terbit di NVD

9 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.hitachi-id.com/cve-2021-3196-attackers-can-impersonate-another-user advisory vendor
• https://www.hitachi.com/hirt/hitachi-sec/2021/601.html exploit · advisory vendor
• https://www.hitachi.com/hirt/security/index.html advisory vendor