CVE-2022-39300
Published on: Not Yet Published
Last Modified on: 10/14/2022 01:16:00 PM UTC
Certain versions of Node Saml from Node Saml Project contain the following vulnerability:
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
- CVE-2022-39300 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity. - Affected Vendor/Software: node-saml - node-saml version < 4.0.0-beta.5
CVSS3 Score: 8.1 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | HIGH | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| Merge pull request from GHSA-5p8w-2mvw-38pv · node-saml/[email protected] · GitHub | github.com text/html |
MISC github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbe |
| Signature bypass via multiple root elements · Advisory · node-saml/node-saml · GitHub | github.com text/html |
CONFIRM github.com/node-saml/node-saml/security/advisories/GHSA-5p8w-2mvw-38pv |
There are currently no QIDs associated with this CVE
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Node Saml Project | Node Saml | All | All | All | All |
| Application | Node Saml Project | Node Saml | 4.0.0 | beta0 | All | All |
| Application | Node Saml Project | Node Saml | 4.0.0 | beta1 | All | All |
| Application | Node Saml Project | Node Saml | 4.0.0 | beta2 | All | All |
| Application | Node Saml Project | Node Saml | 4.0.0 | beta3 | All | All |
| Application | Node Saml Project | Node Saml | 4.0.0 | beta4 | All | All |
- cpe:2.3:a:node_saml_project:node_saml:*:*:*:*:*:node.js:*:*:
- cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta0:*:*:*:node.js:*:*:
- cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta1:*:*:*:node.js:*:*:
- cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta2:*:*:*:node.js:*:*:
- cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta3:*:*:*:node.js:*:*:
- cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta4:*:*:*:node.js:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @CVEreport |
CVE-2022-39300 : node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attack… twitter.com/i/web/status/1… | 2022-10-13 22:15:54 |
| @azu_re |
見てる: "Signature bypass via multiple root elements · CVE-2022-39300 · GitHub Advisory Database" github.com/advisories/GHS… | 2022-10-13 23:53:04 |
| @Robo_Alerts |
Potentially Critical CVE Detected! CVE-2022-39300 node SAML is a SAML 2.0 library based on the SAML implementation… twitter.com/i/web/status/1… | 2022-10-13 23:56:01 |
 /r/netcve |
CVE-2022-39300 | 2022-10-13 23:38:19 |