CVE-2018-0486

Description

Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.921

Associated Vulnerability

Vulnerability	OS Platform
SUSE-SU-2018:0720-1(SUSE Linux Enterprise Server 12-SP2 ) libxmltooling6-1.5.6-3.6.1.x86_64.rpm	Linux
SUSE-SU-2018:0720-1(SUSE Linux Enterprise Server 12-SP2 ) libxmltooling6-debuginfo-1.5.6-3.6.1.x86_64.rpm	Linux
SUSE-SU-2018:0720-1(SUSE Linux Enterprise Server 12-SP2 ) xmltooling-debugsource-1.5.6-3.6.1.x86_64.rpm	Linux
SUSE-SU-2018:0720-1(SUSE Linux Enterprise Server 12-SP2 ) xmltooling-schemas-1.5.6-3.6.1.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234