In short
- CVE-2020-5261 is a MEDIUM (CVSS 6.8) vulnerability affecting Sustainsys.Saml2, saml2 (sustainsys).
- Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.3% of all vulnerabilities.
- Fix: update to 2.5.0 or later.
| Package | Affected versions | Patched versions |
|---|
| Sustainsys.Saml2 NuGet | ≥ 2.0.0, < 2.5.0
| 2.5.0
|
| saml2 | ≥ 2.0.0, < 2.5.0
| 2.5.0
|
Description
Impact
Token Replay Detection is an important defence in depth measure for Single Sign On solutions. In all previous 2.X versions, the Token Replay Detection is not properly implemented.
Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use.
Patches
The 2.5.0 version is patched.
Workarounds
There are no workarounds with existing versions. Fixing the issue requires code updates.
References
https://en.wikipedia.org/wiki/Replay_attack
For more information
If you have any questions or comments about this advisory:
- Comment on #711.
- Email us at [email protected] if you think that there are further security issues.
NVD description
Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use.
More vulnerabilities in Sustainsys.Saml2
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free