CVE-2023-49087

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

VendorProductVersions
simplesamlphpxml-security= 1.6.11; = 5.0.0-alpha.12

References

Timeline

Published
Nov 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-490884.8Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomCVE-2023-490896.5Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.0, BackoffiCVE-2023-49094.3Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI viaCVE-2023-490906.1CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypassCVE-2023-490919.8Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. CoCVE-2023-490925.9RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key iCVE-2023-490938.8HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attackerCVE-2023-490944.3Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make SymbolicatorCVE-2023-490957.5nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate anCVE-2023-490968.8Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosCVE-2023-490978.8ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to builCVE-2023-490983.5Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exp