CVE-2015-5372

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-09-28 · updated 2026-06-17
Weakness: CWE-287

Description

The SAML 2.0 implementation in AdNovum nevisAuth 4.13.0.0 before 4.18.3.1, when using SAML POST-Binding, does not match all attributes of the X.509 certificate embedded in the assertion against the certificate from the identity provider (IdP), which allows remote attackers to inject arbitrary SAML assertions via a crafted certificate.

Affected products

Adnovum Nevisauth: through 4.18.3.0

References

http://blog.csnc.ch/2015/09/saml-sp-authentication-bypass-vulnerability-in-nevisauth
http://packetstormsecurity.com/files/133628/nevisAuth-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2015/Sep/87
http://www.csnc.ch/misc/files/advisories/CVE-2015-5372_AdNovum_nevisAuth_Authentication_Bypass.txt
http://www.securityfocus.com/archive/1/536508/100/0/threaded
http://blog.csnc.ch/2015/09/saml-sp-authentication-bypass-vulnerability-in-nevisauth
http://packetstormsecurity.com/files/133628/nevisAuth-Authentication-Bypass.html
http://seclists.org/fulldisclosure/2015/Sep/87
http://www.csnc.ch/misc/files/advisories/CVE-2015-5372_AdNovum_nevisAuth_Authentication_Bypass.txt
http://www.securityfocus.com/archive/1/536508/100/0/threaded

Get alerted when CVE-2015-5372 or the next vulnerability affects your stack