QwikSec

Security Database

CVE

CWE

Training

CVE-2021-33054

Published: Jun 4, 2021

Modified: Aug 3, 2024

PUBLISHED

Description

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://www.sogo.nu/news.html

x_refsource_MISC

https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md

x_refsource_MISC

https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html

x_refsource_MISC

[debian-lts-announce] 20210712 [SECURITY] [DLA 2707-1] sogo security update

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_DEBIAN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.