CVE-2012-5352
Java Open Single Sign-On Project Home - Authentication Bypass via SAML Assertion Signature Exclusion
Title source: llmDescription
Java Open Single Sign-On Project Home (JOSSO) allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."
References (4)
Core 4
Core References
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=865169
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/55892
Various Sources x_refsource_misc
http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79241
Scores
EPSS
0.0252
EPSS Percentile
82.8%
Details
CWE
CWE-287
Status
published
Products (1)
josso/java_open_single_sign-on_project_home
Published
Oct 09, 2012
Tracked Since
Feb 18, 2026