CVE-2020-13101
HIGHOASIS Digital Signature Services 1.0 - Cryptographic Signature Verification Bypass via InlineXML Option
Title source: llmDescription
In OASIS Digital Signature Services (DSS) 1.0, an attacker can control the validation outcome (i.e., trigger either a valid or invalid outcome for a valid or invalid signature) via a crafted XML signature, when the InlineXML option is used. This defeats the expectation of non-repudiation.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=dss-x
Permissions Required, Vendor Advisory x_refsource_misc
https://www.oasis-open.org/apps/org/workgroup/dss-x/
Vendor Advisory x_refsource_misc
https://www.oasis-open.org/standards#dssv1.0
Scores
CVSS v3
7.5
EPSS
0.0073
EPSS Percentile
49.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-347
Status
published
Products (1)
oasis-open/oasis_digital_signature_services
1.0
Published
Aug 24, 2020
Tracked Since
Feb 18, 2026