CVE-2012-5353

MEDIUM 5.8CVE-2012-5353 · Published 09/10/2012 · updated 16/06/2026

In short

CVE-2012-5353 is a MEDIUM (CVSS 5.8) vulnerability affecting openathens service provider (eduserv).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
openathens service provider eduserv	`= 2.0`	No fix yet

Description

Eduserv OpenAthens SP 2.0 for Java allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."

References

status.openathens.net/adv.php
nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free