| Package | Affected versions | Patched versions |
|---|---|---|
| shib auth | = 5.x-1.x= 5.x-2.1= 5.x-2.2= 5.x-2.4= 5.x-2.5= 5.x-2.x= 5.x-3.3= 5.x-3.x= 6.x-1.x= 6.x-2.0= 6.x-2.1= 6.x-2.2= 6.x-2.x= 6.x-3.0= 6.x-3.1= 6.x-3.x |
The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically granted privileges after a logout or other session change, which allows physically proximate attackers to gain privileges by using an unattended web browser.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free