CVE-2020-27978 in Identify Provider

Sumário

de MITRE • 28/10/2020

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Reservar: 28/10/2020
• Divulgação: 28/10/2020
• Moderação: aceite
• Entrada: VDB-164030
• CPE: pronto
• CWE: CWE-404 (confirmado)
• CVSS: 7.5 (NVD)
• EPSS: 0.01855
• KEV: não
• Atividades: muito baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2020-27978
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-27978
• CVE Details: https://www.cvedetails.com/cve/CVE-2020-27978/