Lasso SAML Implementation Vulnerability Affecting Cisco Products: June 2021
On June 1, 2021, Lasso disclosed a security vulnerability in the Lasso Security Assertion Markup Language (SAML) Single Sign-On (SSO) library. This vulnerability could allow an authenticated attacker to impersonate another authorized user when interacting with an application. For a description of this vulnerability, see lasso.git NEWS ["https://git.entrouvert.org/lasso.git/tree/NEWS?id=v2.7.0"]. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lasso-saml-jun2021-DOXNRLkD ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lasso-saml-jun2021-DOXNRLkD"]
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-28091US | high7.5 | — | ||
Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Cisco Bug Search Toolexternal
- CSCvx73154external
- CSCvx73156external
- CSCvx73157external
- CSCvx73162external
- CSCvx73164external
- lasso.git NEWSexternal
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lasso-saml-jun2021-DOXNRLkDexternal
Behebungen (1)
- BehobenCisco Email Security Appliance (ESA)
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan