VULNERABILITY INTELLIGENCE

CVE-2017-11427

CVSS score7.7 HIGH

EPSS probability4.37%

CISA KEVNot currently listed

Published2019-04-17

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Description

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Weakness classification

security@duo.com: CWE-287
nvd@nist.gov: CWE-287

Primary references

security@duo.com — Exploit, Technical Description, Third Party Advisory
security@duo.com — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource