Back to Database
Status published
High
CVE-2020-5407
Signature Wrapping Vulnerability with spring-security-saml2-service-provider
Vulnerability Description
Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5407
Credits & Attribution
No credits recorded in the NVD database.
References
- https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E
- https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E
- https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://tanzu.vmware.com/security/cve-2020-5407
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
More from Spring by VMware
View All →CVE-2020-5428
Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query
Medium
5.1
CVE-2020-5427
Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query
Medium
5.7
CVE-2020-5421
RFD Protection Bypass via jsessionid
High
8.7
CVE-2020-5413
Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"
Critical
9.8
CVE-2020-5412
Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard
Medium
6.5
Affected Vendor
Spring by VMware
View all reports →Affected Software
Spring Security
Vulnerable Versions:
5.2, 5.3
Timeline
Official Publish:
May 13th, 2020
Last Modified:
September 16th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H