CVE-2021-23365
Assigner: snyk
Published: 2021-04-26T00:00:00
State: PUBLISHED
affected: product: github.com/TykTechnologies/tyk-identity-broker
vendor: n/a
versions: lessThan: 1.1.1
status: affected
version: unspecified
versionType: custom
credits: value: Sredny M.
datePublic: 2021-04-26T00:00:00
descriptions: value: The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
problemTypes: descriptions: description: Authentication Bypass
type: text
title: Authentication Bypass