CVE-2017-11430

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
OmniAuth	OmnitAuth-SAML	>= unspecified, < 1.9.0

References

https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementationsExploit, Technical Description, Third Party Advisory
https://www.kb.cert.org/vuls/id/475445Third Party Advisory, US Government Resource
https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementationsExploit, Technical Description, Third Party Advisory
https://www.kb.cert.org/vuls/id/475445Third Party Advisory, US Government Resource

Timeline

Published: Apr 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-114345.5The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-boun CVE-2017-114359.8The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the managem CVE-2017-114369.8D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access CVE-2017-114376.5GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a proj CVE-2017-114386.3GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create CVE-2017-114395.4In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.CVE-2017-11442.5IBM WebSphere Message Broker could allow a local user with specialized access to prevent the message broker from starting. IBM X-Force ID: 1 CVE-2017-114404.9In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx CVE-2017-114415.4The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33 CVE-2017-114449.8Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.CVE-2017-114459.8Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.CVE-2017-114466.5The ReadPESImage function in coders\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU exhaustion via a craf