CVE-2018-1000165

    Dashboard / Vulnerabilities / CVE-2018-1000165

    CVE-2018-1000165

    Published: 18 Apr 2018Last Modified: 8 Jul 2026

    Summary:

    Details: LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.

    References: https://github.com/lightSAML/lightSAML/releases/tag/1.3.5, https://github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a7f60056384db50baba0449ba06d4fc4076280f0

    Affected versions

    1.3.3
    1.3.2
    1.3.1
    1.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High