VULNERABILITY INTELLIGENCE
CVE-2018-0486
CVSS score6.5 MEDIUM
EPSS probability1.53%
CISA KEVNot currently listed
Published2018-01-13
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.
Weakness classification
- CWE-347: Improper Verification of Cryptographic Signature
Primary references
- security@debian.org — Third Party Advisory, VDB Entry
- security@debian.org — Mailing List, Third Party Advisory
- security@debian.org — Mailing List, Third Party Advisory
- security@debian.org — Vendor Advisory
- security@debian.org — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory