What’s Vulnerable › Vulnerabilities

CVE-2023-36661

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-25 · updated 2026-06-17
• Weakness: CWE-918

Description

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)

Affected products

• Debian Linux: 11.0, 12.0
• Shibboleth Xmltooling: before 3.2.4 — fixed in 3.2.4

How to fix

Upgrade to a fixed version: Shibboleth Xmltooling 3.2.4. Check the vendor advisory for mitigations.

References

• https://shibboleth.net/community/advisories/secadv_20230612.txt
• https://www.debian.org/security/2023/dsa-5432
• https://shibboleth.net/community/advisories/secadv_20230612.txt
• https://www.debian.org/security/2023/dsa-5432

Get alerted when CVE-2023-36661 or the next vulnerability affects your stack