In breve
- CVE-2023-34205 è una vulnerabilità CRITICO (CVSS 9.1) che riguarda github.com/moov-io/signedxml, signedxml (moov).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.39%, superiore al 33.2% delle vulnerabilità.
- Correzione: aggiornare a 1.1.0 o successiva.
Description
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
NVD description
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
Altre vulnerabilità di github.com/moov-io/signedxml
Vedi tutto →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free