Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-F7E9A1CC-0931-11EE-94B4-6CC21735F730: xmltooling -- remote resource access

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

FreeBSD: VID-F7E9A1CC-0931-11EE-94B4-6CC21735F730: xmltooling -- remote resource access

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
06/12/2023
Created
06/14/2023
Added
06/13/2023
Modified
06/13/2023

Description

Shibboleth consortium reports:

An updated version of the XMLTooling library that is part of the

OpenSAML and Shibboleth Service Provider software is now available

which corrects a server-side request forgery (SSRF) vulnerability.

Including certain legal but "malicious in intent" content in the

KeyInfo element defined by the XML Signature standard will result

in attempts by the SP's shibd process to dereference untrusted

URLs.

While the content of the URL must be supplied within the message

and does not include any SP internal state or dynamic content,

there is at minimum a risk of denial of service, and the attack

could be combined with others to create more serious vulnerabilities

in the future.

Solution(s)

  • freebsd-upgrade-package-xmltooling

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;