CVE-2017-16853

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/101898Third Party Advisory, VDB Entry
https://bugs.debian.org/881856Issue Tracking, Third Party Advisory
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html
https://shibboleth.net/community/advisories/secadv_20171115.txtIssue Tracking, Vendor Advisory
https://www.debian.org/security/2017/dsa-4039Issue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/101898Third Party Advisory, VDB Entry
https://bugs.debian.org/881856Issue Tracking, Third Party Advisory
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html
https://shibboleth.net/community/advisories/secadv_20171115.txtIssue Tracking, Vendor Advisory
https://www.debian.org/security/2017/dsa-4039Issue Tracking, Third Party Advisory

Timeline

Published: Nov 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-168546.5In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in a CVE-2017-168566.1The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross sit CVE-2017-168578.5It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the bac CVE-2017-168586.8The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 al CVE-2017-168596.5The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.CVE-2017-168606.1The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from versio CVE-2017-168619.8It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker CVE-2017-168624.3The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist sett CVE-2017-168636.1The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site s CVE-2017-168646.1The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross CVE-2017-168655.3The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a CVE-2017-168666.1dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.