CVE-2011-1411 Improper Authentication in OpenSAML
Remote attackers can forge SAML messages to bypass authentication and gain unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1411?
CVE-2011-1411 is a medium-severity authentication bypass vulnerability in n/a, published on 2 Sep 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Weakness: CWE-287
Which versions are affected by CVE-2011-1411?
4 open source packages ship an affected version, including org.opensaml:opensaml. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.opensaml:opensaml Maven | From 2.4.0 | 2.4.3 |
org.opensaml:opensaml Maven | From 2.4.0 | 2.4.3 |
org.opensaml:opensaml Maven | From 2.5.0 | 2.5.1 |
org.opensaml:opensaml Maven | From 2.5.0 | 2.5.1 |
Products include Shibboleth Opensaml, Shibboleth Shibboleth-Identity-Provider.
How do I fix CVE-2011-1411?
Upgrade org.opensaml:opensaml to a fixed version for your release line: 2.4.3 or 2.5.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2011-1411 being exploited?
There is no known exploitation of CVE-2011-1411 in the wild and no public exploit code.
Sources
Also known as DSA-2284-1, GHSA-qwwj-qj3f-9hv7.