CVE Feed

    Dashboard / CVE / CVE-2019-19191

    CVE-2019-19191

    Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow.

    Published:Nov 21, 2019
    Last Modified:Nov 21, 2024
    EPS:Nov 21, 2019
    EPSS Score:0.00172
    CVSS Score:7.8

    Affected Products

    Vendor
    Shibboleth
    Product
    Service Provider

    Exploits

    https://bugzilla.suse.com/show_bug.cgi?id=1157471https://bugzilla.suse.com/show_bug.cgi?id=1157471

    Related CVEs

    CVE-2025-9943 (CVSS 9.1) — An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay …
    CVE-2023-22947 (CVSS 7.3) — Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 …
    CVE-2021-31826 (CVSS 7.5) — Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session…
    CVE-2021-28963 (CVSS 5.3) — Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-co…
    CVE-2010-2450 (CVSS 7.5) — The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to cr…
    CVE-2017-16852 (CVSS 8.1) — shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provi…
    CVE-2015-2684 (CVSS 4) — Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High