CVE-2019-3465

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

VendorProductVersions
n/aRob Richards XmlSecLibsAll versions prior to version 3.0.3

References

Timeline

Published
Nov 7, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-34667.8The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary direCVE-2019-34677.8Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too perCVE-2019-34746.5A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privCVE-2019-34757.8A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low priCVE-2019-34769.8Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbitrary code execution.CVE-2019-34776.1Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.CVE-2019-34799.8Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.CVE-2019-34806.1Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.CVE-2019-34817.1Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.CVE-2019-34826.5Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.CVE-2019-34836.5Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.CVE-2019-34847.8Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.
CVE-2019-3465: High severity, CVSS 8.8 | Vulnix