CVE Feed

    Dashboard / CVE / CVE-2021-31826

    CVE-2021-31826

    Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied.

    Published:Apr 27, 2021
    Last Modified:Nov 21, 2024
    EPS:Apr 27, 2021
    EPSS Score:0.01478
    CVSS Score:7.5

    Affected Products

    Vendor
    Shibboleth
    Product
    Service Provider

    Exploits

    https://issues.shibboleth.net/jira/browse/SSPCPP-927https://issues.shibboleth.net/jira/browse/SSPCPP-927

    Common Weakness Enumeration

    CWE-476 NULL Pointer Dereference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-9943 (CVSS 9.1) — An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay …
    CVE-2023-22947 (CVSS 7.3) — Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 …
    CVE-2021-28963 (CVSS 5.3) — Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-co…
    CVE-2019-19191 (CVSS 7.8) — Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory…
    CVE-2010-2450 (CVSS 7.5) — The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to cr…
    CVE-2017-16852 (CVSS 8.1) — shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provi…
    CVE-2015-2684 (CVSS 4) — Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High