Loading...
Skip to main content
GeekWala

CVE-2023-41890 — Vulnerability in Sustainsys.Saml2 — CVE Details

HIGH

Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

Published September 20, 2023Updated October 14, 2024Source: osv

Summary

### Impact When a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity provider to craft a Saml2 response that is processed as if issued by another identity provider. It is also possible for a malicious end user to cause stored state intended for one identity provider to be used when processing the response from another provider. An application is impacted if they rely on any of these features in their authentication/authorization logic: * the issuer of the generated identity and claims * items in the stored request state (AuthenticationProperties) ### Patches Patched in version 2.9.2 and 1.0.3. All previous versions are vulnerable. ### Workarounds The `AcsCommandResultCreated` notification can be used to add the validation required if an upgrade to patched packages is not possible. ### References The patch is linked to https://github.com/Sustainsys/Saml2/issues/712 and https://github.com/Sustainsys/Saml2/issues/713

Advisory Timeline

  • First published September 20, 2023 (1118 days ago).
  • Last revised October 14, 2024 — 390 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update Sustainsys.Saml2 to 2.9.2 or later
dotnet add package Sustainsys.Saml2 --version 2.9.2
NuGet
Update Sustainsys.Saml2 to 1.0.3 or later
dotnet add package Sustainsys.Saml2 --version 1.0.3

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: nuget (2).

PackageEcosystemAffectedFixed In
Sustainsys.Saml2
nuget
2.0.0, 2.1.0, 2.2.0, 2.3.0 (+7 more)2.9.2
Kentor.AuthServices
nuget
0.1.0, 0.10.0, 0.11.0, 0.12.0 (+28 more)Range-based data available
Sustainsys.Saml2
nuget
0.23.0, 0.24.0, 1.0.0, 1.0.1 (+1 more)1.0.3

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Frequently Asked Questions

What is CVE-2023-41890?
Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2023-41890?
CVE-2023-41890 affects Sustainsys.Saml2 and Kentor.AuthServices. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-41890 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-fv2h-753j-9g39

Related CVEs

  • CVE-2026-106112
    HIGH

    ImageSharp: ICC LUT16 output channel count can write beyond Vector4

  • CVE-2020-5261
    HIGH

    Missing Token Replay Detection in Saml2 Authentication services for ASP.NET

  • CVE-2026-106115
    HIGH

    ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

  • CVE-2020-5268
    MEDIUM

    Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies