by Kastro
Paper/Archive/CVE-2020-27847

CVE-2020-27847

redhat — A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation.

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 77.4.774 × 2015.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.

Affected

ProductAffectedFixed inSource
dexidp/dexdex 2.27.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refmattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilitiesrefbugzilla.redhat.com/show_bug.cgi?id=1907732refgithub.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5