CVE-2023-41890

Summary

CVE-2023-41890 affects the Sustainsys.Saml2 library before versions 1.0.3 and 2.9.2 used in ASP.NET websites for Single Sign-On (SSO) implementation. The vulnerability lies in insufficient validation of the Identity Provider issuer during response processing, enabling a malicious Identity Provider to impersonate another one or a malicious end user to misuse stored state. Applications relying on the issuer of generated identities and claims, or the stored request state, are at risk. The issue is mitigated by upgrading to versions 2.9.2 and 1.0.3, or by implementing the `AcsCommandResultCreated` notification for additional validation if an upgrade is not feasible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.