diff --git a/advisories/github-reviewed/2025/05/GHSA-8gqj-226h-gm8r/GHSA-8gqj-226h-gm8r.json b/advisories/github-reviewed/2025/05/GHSA-8gqj-226h-gm8r/GHSA-8gqj-226h-gm8r.json index 538315b5934..196de43179a 100644 --- a/advisories/github-reviewed/2025/05/GHSA-8gqj-226h-gm8r/GHSA-8gqj-226h-gm8r.json +++ b/advisories/github-reviewed/2025/05/GHSA-8gqj-226h-gm8r/GHSA-8gqj-226h-gm8r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8gqj-226h-gm8r", - "modified": "2025-05-06T21:19:22Z", + "modified": "2025-05-06T21:43:54Z", "published": "2025-05-06T21:18:49Z", "aliases": [ "CVE-2025-46573" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-8gqj-226h-gm8r" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46573" + }, { "type": "WEB", "url": "https://github.com/auth0/passport-wsfed-saml2/commit/e5cf3cc2a53748207f7a81bfba9195c8efa94181" @@ -54,11 +58,12 @@ ], "database_specific": { "cwe_ids": [ + "CWE-287", "CWE-290" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2025-05-06T21:18:49Z", - "nvd_published_at": null + "nvd_published_at": "2025-05-06T21:16:20Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-rwj2-w85g-5cmm/GHSA-rwj2-w85g-5cmm.json b/advisories/github-reviewed/2025/05/GHSA-rwj2-w85g-5cmm/GHSA-rwj2-w85g-5cmm.json index 27dacba584d..911a1a43291 100644 --- a/advisories/github-reviewed/2025/05/GHSA-rwj2-w85g-5cmm/GHSA-rwj2-w85g-5cmm.json +++ b/advisories/github-reviewed/2025/05/GHSA-rwj2-w85g-5cmm/GHSA-rwj2-w85g-5cmm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rwj2-w85g-5cmm", - "modified": "2025-05-06T16:45:17Z", + "modified": "2025-05-06T21:44:02Z", "published": "2025-05-06T16:45:17Z", "aliases": [ "CVE-2025-46816" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-rwj2-w85g-5cmm" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46816" + }, { "type": "WEB", "url": "https://github.com/patrickhener/goshs/commit/160220974576afe5111485b8d12fd36058984cfa" @@ -60,6 +64,6 @@ "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2025-05-06T16:45:17Z", - "nvd_published_at": null + "nvd_published_at": "2025-05-06T19:16:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-wjmp-wphq-jvqf/GHSA-wjmp-wphq-jvqf.json b/advisories/github-reviewed/2025/05/GHSA-wjmp-wphq-jvqf/GHSA-wjmp-wphq-jvqf.json index 88f55bbf838..f9ac3af7007 100644 --- a/advisories/github-reviewed/2025/05/GHSA-wjmp-wphq-jvqf/GHSA-wjmp-wphq-jvqf.json +++ b/advisories/github-reviewed/2025/05/GHSA-wjmp-wphq-jvqf/GHSA-wjmp-wphq-jvqf.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-wjmp-wphq-jvqf", - "modified": "2025-05-06T21:19:04Z", + "modified": "2025-05-06T21:43:47Z", "published": "2025-05-06T21:18:43Z", "aliases": [ "CVE-2025-46572" ], "summary": "Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping", - "details": "### Overview\nThis vulnerability allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP.\n\n### Am I Affected?\nYou are affected by this SAML Signature Wrapping vulnerability if you are using `passport-wsfed-saml2` version 4.5.1 or below, specifically under the following conditions:\n1. The service provider is using `passport-wsfed-saml2`,\n2. A valid SAML document signed by the Identity Provider can be obtained.\n\n### Fix\nUpgrade to v4.6.4 or greater.", + "details": "### Overview\nThis vulnerability allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP.\n\n### Am I Affected?\nYou are affected by this SAML Signature Wrapping vulnerability if you are using `passport-wsfed-saml2` version 4.6.3 or below, specifically under the following conditions:\n1. The service provider is using `passport-wsfed-saml2`,\n2. A valid SAML document signed by the Identity Provider can be obtained.\n\n### Fix\nUpgrade to v4.6.4 or greater.", "severity": [ { "type": "CVSS_V4", @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-wjmp-wphq-jvqf" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46572" + }, { "type": "WEB", "url": "https://github.com/auth0/passport-wsfed-saml2/commit/e5cf3cc2a53748207f7a81bfba9195c8efa94181" @@ -54,11 +58,12 @@ ], "database_specific": { "cwe_ids": [ + "CWE-287", "CWE-347" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2025-05-06T21:18:43Z", - "nvd_published_at": null + "nvd_published_at": "2025-05-06T21:16:20Z" } } \ No newline at end of file