CVE-2021-39171

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Uncontrolled Resource Consumption pada passport-saml project passport-saml. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.

Rincian

Terbit di NVD

27 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/node-saml/passport-saml/pull/595 patch · advisory pihak ketiga
• https://github.com/node-saml/passport-saml/security/advisories/GHSA-5379-r78w-42h2 advisory pihak ketiga