CVE-2011-1411

Published: Sep 2, 2011Modified: Apr 29, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

Affected (15)

Products: Shibboleth: Opensaml, Shibboleth Identity Provider

Shibboleth

2 products

Opensaml

Shibboleth Identity Provider

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Shibboleth Opensaml	Version 2.4.0
Shibboleth Opensaml	Version 2.4.1
Shibboleth Opensaml	Version 2.4.2
Shibboleth Opensaml	Version 2.5.0

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Shibboleth Shibboleth Identity Provider	Up to 2.3.1
Shibboleth Shibboleth Identity Provider	Version 2.0.0
Shibboleth Shibboleth Identity Provider	Version 2.1.0
Shibboleth Shibboleth Identity Provider	Version 2.1.1
Shibboleth Shibboleth Identity Provider	Version 2.1.2
Shibboleth Shibboleth Identity Provider	Version 2.1.3
Shibboleth Shibboleth Identity Provider	Version 2.1.4
Shibboleth Shibboleth Identity Provider	Version 2.1.5
Shibboleth Shibboleth Identity Provider	Version 2.2.0
Shibboleth Shibboleth Identity Provider	Version 2.2.1
Shibboleth Shibboleth Identity Provider	Version 2.3.0