Shibboleth SQL Injection Vulnerability

CRITICAL (9.1)
cwe-89samlshibbolethspsql-injectionvulnerability

Threat Intelligence

Low Risk
EPSS Score: 0.14% chance of exploitation (percentile: 35%)
🔍 Detection Tools: None available in major open-source tools
⚔️ Exploit Availability: No public exploits found

How we test →

What is it?

The Shibboleth Service Provider is a software used by organizations to manage identity and access. This vulnerability allows an attacker to inject malicious SQL code into the database, potentially extracting sensitive data or disrupting system operations.

Am I affected?

You're affected if you use An SQL. Affected versions: 3.5.0 If you don't recognise this software, you're probably not affected.

How to fix

To fix this vulnerability, upgrade to Shibboleth Service Provider version 3.5.1 or later from the official website: https://shibboleth.net/downloads/service-provider/3.5.1/. Alternatively, apply immediate mitigations:

  • Disable the replay cache by setting replayCacheEnabled to false in your shibboleth2.xml configuration file.
  • Update your database connection settings to use a secure storage service.

References