Vulnerability Details : CVE-2009-3474
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
Exploit prediction scoring system (EPSS) score for CVE-2009-3474
Probability of exploitation activity in the next 30 days: 0.68%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 79 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2009-3474
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2009-3474
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-3474
- http://www.debian.org/security/2009/dsa-1896
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/53474
-
http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt
Patch;Vendor Advisory
-
http://www.securityfocus.com/bid/36516
Patch
-
https://bugs.internet2.edu/jira/browse/CPPOST-28
- http://www.debian.org/security/2009/dsa-1895
Products affected by CVE-2009-3474
- cpe:2.3:a:internet2:opensaml:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:opensaml:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:opensaml:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:xmltooling:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:xmltooling:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:xmltooling:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:xmltooling:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:1.3f:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:1.3b:*:*:*:*:*:*:*
- cpe:2.3:a:internet2:shibboleth-sp:1.3.2:*:*:*:*:*:*:*