VULNERABILITY INTELLIGENCE

CVE-2010-2450

CVSS score7.5 HIGH
EPSS probability1.20%
CISA KEVNot currently listed
Published2019-11-07
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-916: Use of Password Hash With Insufficient Computational Effort

Primary references