CVE-2025-31335

Published: Mar 28, 2025Modified: Mar 28, 2025

4.0

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Exploitability: 2.2 / Impact: 1.4

Source: MITRE (Secondary)

Description

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures).

Related CWEs

CWE-347

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (4)

https://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=22a610b322e2178abd03e97cdbc8fb50b45efaee

Source: cve@mitre.org

https://lists.debian.org/debian-security-announce/2025/msg00041.html

Source: cve@mitre.org

https://shibboleth.atlassian.net/browse/CPPOST-126

Source: cve@mitre.org

https://shibboleth.net/community/advisories/secadv_20250313.txt

Source: cve@mitre.org

Timeline

No history available yet.