DRUPAL-CONTRIB-2020-038 This module enables your users residing at a SAML 2.0 compliant Identity Provider to login to your Drupal website.
An authentication bypass in the Drupal SAML module allows attackers to log in without valid credentials, potentially taking over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2020-038?
DRUPAL-CONTRIB-2020-038 is an authentication bypass vulnerability in drupal/miniorange_saml, published on 18 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This module enables your users residing at a SAML 2.0 compliant Identity Provider to login to your Drupal website.
The module has two Authentication Bypass vulnerabilities.
Which versions are affected by DRUPAL-CONTRIB-2020-038?
Linux distribution packages (1)
drupal/miniorange_saml Packagist:https://packages.drupal.org/8 | All versions | 2.14.0 |
How do I fix DRUPAL-CONTRIB-2020-038?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is DRUPAL-CONTRIB-2020-038 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2020-038 in the wild and no public exploit code.