VULNERABILITY INTELLIGENCE
CVE-2017-16852
CVSS score8.1 HIGH
EPSS probability1.10%
CISA KEVNot currently listed
Published2017-11-16
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.
Weakness classification
- CWE-347: Improper Verification of Cryptographic Signature
Primary references
- cve@mitre.org — Issue Tracking, Third Party Advisory
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org — Issue Tracking, Vendor Advisory
- cve@mitre.org — Issue Tracking, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory