What’s Vulnerable › Vulnerabilities

CVE-2020-13415

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-05-22 · updated 2026-06-17
• Weakness: CWE-347

Description

An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (even if that SAML assertion has expired or is from a user who is not authorized to access Aviatrix), aka XML Signature Wrapping.

Affected products

• Aviatrix Controller: through 5.1

References

• https://docs.aviatrix.com/HowTos/security_bulletin_article.html#xml-signature-wrapping-in-saml
• https://docs.aviatrix.com/HowTos/security_bulletin_article.html#xml-signature-wrapping-in-saml

Get alerted when CVE-2020-13415 or the next vulnerability affects your stack