{"id":"GHSA-vg4f-8v9q-5c3x","aliases":["CVE-2018-1000165"],"title":"LightSAML Incorrect Access Control vulnerability","description":"LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in `src/LightSaml/Model/XmlDSig/` that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.","severity":"high","score":7.5,"published":"2022-05-13T01:48:33.000Z","modified":"2024-04-23T17:43:53.138Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"lightsaml/lightsaml","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.3.5"}],"type":"ECOSYSTEM"}],"versions":["0.1.0","1.0.0","1.0.0-beta.1","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3"],"fixed":["1.3.5"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2018-1000165","https://github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a","https://github.com/lightSAML/lightSAML","https://github.com/lightSAML/lightSAML/releases/tag/1.3.5"],"sources":[{"name":"OSV","id":"GHSA-vg4f-8v9q-5c3x","modified":"2024-04-23T17:43:53.138176Z","url":"https://osv.dev/vulnerability/GHSA-vg4f-8v9q-5c3x"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}]}