Description
Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Remediation
References
https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
https://www.kb.cert.org/vuls/id/475445
Related Vulnerabilities
CVE-2023-25827 Vulnerability in maven package net.opentsdb:opentsdb
CVE-2020-7630 Vulnerability in npm package git-add-remote
CVE-2023-26487 Vulnerability in npm package vega
CVE-2022-24847 Vulnerability in maven package org.geoserver:gs-main
CVE-2023-36470 Vulnerability in maven package org.xwiki.platform:xwiki-platform-icon-default