An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (even if that SAML assertion has expired or is from a user who is not authorized to access Aviatrix), aka XML Signature Wrapping.
References
Link | Resource |
---|---|
https://docs.aviatrix.com/HowTos/security_bulletin_article.html#xml-signature-wrapping-in-saml | Exploit Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-05-22T20:48:23
Updated: 2020-05-22T20:48:23
Reserved: 2020-05-22T00:00:00
Link: CVE-2020-13415
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-05-22T21:15:12.817
Modified: 2020-05-26T19:55:30.020
Link: CVE-2020-13415
JSON object: View
Redhat Information
No data.
CWE