by Kastro
Paper/Archive/CVE-2025-40934

CVE-2025-40934

TIMLEGGE XML::Sig — XML-Sig prior to 0.68 for Perl improperly validates XML without signatures

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
29
CVSS 9.3 (ADP)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 7.2.072 × 201.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files.  An unsigned XML file should return an error message.  The affected versions return true when attempting to validate an XML file that contains no signatures.

Affected

ProductAffectedFixed inSource
XML::Sig0.27 – < 0.680.68CNA

Scores by source

CISA ADP9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/perl-net-saml2/perl-XML-Sig/issues/63patchgithub.com/perl-net-saml2/perl-XML-Sig/pull/64