En resumen
- CVE-2023-34205 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a github.com/moov-io/signedxml, signedxml (moov).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.39%, mayor que el 33.3% de las vulnerabilidades.
- Solución: actualizar a 1.1.0 o posterior.
Description
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
NVD description
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
Más vulnerabilidades de github.com/moov-io/signedxml
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free