VULNERABILITY INTELLIGENCE
CVE-2015-5372
CVSS score5 MEDIUM
EPSS probability0.87%
CISA KEVNot currently listed
Published2015-09-28
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:N
Description
The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of the X.509 certificate embedded in the assertion against the certificate from the identity provider (IdP), which allows remote attackers to inject arbitrary SAML assertions via a crafted certificate.
Weakness classification
- CWE-287: Improper Authentication