CVE-2020-27846

highPriorität · verfolgen · 41EPSS 0.049 · 92. PerzentilDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

4.93% (92nd) EPSS

CVSS 10 · high

Is it mine?

28 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · osv · balluff_psirt

EPSS · bewertet 2026-10-27

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobengrafana-0:7.3.6-2.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1859
Behobengrafana-0:7.3.6-2.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1859
Behobengrafana-0:7.3.6-2.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1859
Behobengrafana-0:7.3.6-2.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1859
Behobengrafana-0:7.3.6-2.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1859
Behobengrafana-debuginfo-0:7.3.6-2.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1859
Behobengrafana-debuginfo-0:7.3.6-2.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1859
Behobengrafana-debuginfo-0:7.3.6-2.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1859
Behobengrafana-debuginfo-0:7.3.6-2.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2021:1859
Behobenballuff_psirt
Update to the firmware version 2.4.1.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

10.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 9–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 10

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Balluff PSIRT

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-115USCWE-115USCWE-115USCWE-115USCWE-287US

betroffene Produkte (28)

Betroffene Produkte und Versionsbereiche.

Firmware 2.4.1 installed on BAV MA-NC-00025-01alle Versionenfixedballuff_psirtDEcpe:2.3:o:balluff_gmbh:BAV_MA-NC-00025-01_firmware:2.4.1:*:*:*:*:*:*:*
Firmware 2.4.1 installed on BNI EGW-720-007-K095alle Versionenfixedballuff_psirtDEcpe:2.3:o:balluff_gmbh:BNI_EGW-720-007-K095_firmware:2.4.1:*:*:*:*:*:*:*
Firmware <2.4.1 installed on BAV MA-NC-00025-01alle Versionenballuff_psirtDEcpe:2.3:o:balluff_gmbh:BAV_MA-NC-00025-01_firmware:*:*:*:*:*:*:*:*
Firmware <2.4.1 installed on BNI EGW-720-007-K095alle Versionenballuff_psirtDEcpe:2.3:o:balluff_gmbh:BNI_EGW-720-007-K095_firmware:*:*:*:*:*:*:*:*
n/a crewjam/saml≤ grafana-7.3.6, grafana-7.2.3, grafana-6.7.5, github.com/crewjam/saml-0.4.3enisa_euvdEU
fedoraproject fedora= 32nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 33nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
grafana grafana< 6.7.5nvdUScpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
grafana grafana7.0.0 → 7.2.3nvdUScpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
grafana grafana7.3.0 → 7.3.6nvdUScpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
redhat enterprise linux= 8.0nvdUScpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*
redhat openshift container platform= 3.11nvdUScpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
redhat openshift container platform= 4.0nvdUScpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
redhat openshift service mesh= 2.0nvdUScpe:2.3:a:redhat:openshift_service_mesh:*:*:*:*:*:*:*:*
saml project saml< 0.4.3nvdUScpe:2.3:a:saml_project:saml:*:*:*:*:*:*:*:*
Bitnami grafana< 6.7.5osvUSpkg:bitnami/grafana
Bitnami grafana7.0.0 → 7.2.3osvUSpkg:bitnami/grafana
Bitnami grafana7.3.0 → 7.3.6osvUSpkg:bitnami/grafana
Go github.com/crewjam/saml< 0.4.3osvUSpkg:golang/github.com/crewjam/saml
grafana-0:7.3.6-2.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)alle Versionenfixedredhat_csafUS

20 von 28 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2021:1859Red Hat Security Advisory: grafana security, bug fix, and enhancement update2021-05-18csaf · redhat_csafUS
An update for grafana is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
VDE-2026-049Balluff GmbH: Multiple Vulnerabilities Affecting BNI EGW-720-007-K095 and BAV MA-NC-00025-012026-06-30csaf · balluff_psirtDE
Security advisory for Balluff BNI EGW-720-007-K095 and BAV MA-NC-00025-01 firmware versions prior to 2.4.1. This advisory covers multiple vulnerabilities affecting software components used by the device firmware.
GHSA-4hq8-gmxx-h6w9XML Processing error in github.com/crewjam/saml2021-06-23ghsa · osvUS
### Impact There are three vulnerabilities in the go `encoding/xml` package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see [xml-roundtrip-validator](https://github.com/mattermost/xml-roundtrip-validator) ### Patches In version 0.4.3, all XML input is validated prior to being parsed.
BIT-grafana-2020-278462024-03-06vendor · osvUS
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
GO-2021-0058Signature validation bypass due to XML processing error in github.com/crewjam/saml2021-04-14vendor · osvUS
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv balluff_psirt nvd redhat_csaf NVD CVE.org MITRE

veröffentlicht 2020-12-21geändert 2026-06-17

Referenzen (27)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan