VULNERABILITY INTELLIGENCE

CVE-2018-7340

CVSS score7.5 HIGH

EPSS probability0.94%

CISA KEVNot currently listed

Published2019-04-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Weakness classification

CWE-287: Improper Authentication
CWE-347: Improper Verification of Cryptographic Signature

Primary references

security@duo.com — Exploit, Vendor Advisory
security@duo.com — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource