CVE-2015-3931

Опубликовано: 21 июл. 2017

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.

Ссылки

http://packetstormsecurity.com/files/132473/Microsec-e-Szigno-Netlock-Mokka-XML-Signature-Wrapping.html
Third Party Advisory
VDB Entry
http://www.neih.gov.hu/?q=node/66
Third Party Advisory
http://www.securityfocus.com/bid/75487
Third Party Advisory
VDB Entry
https://e-szigno.hu/letoltesek/programok-driverek.html
Vendor Advisory
https://www.search-lab.hu/about-us/news/107-37-million-digitally-signed-documents-had-to-be-reverified
Third Party Advisory
https://www.search-lab.hu/eakta
Third Party Advisory
http://packetstormsecurity.com/files/132473/Microsec-e-Szigno-Netlock-Mokka-XML-Signature-Wrapping.html
Third Party Advisory
VDB Entry
http://www.neih.gov.hu/?q=node/66
Third Party Advisory
http://www.securityfocus.com/bid/75487
Third Party Advisory
VDB Entry
https://e-szigno.hu/letoltesek/programok-driverek.html
Vendor Advisory
https://www.search-lab.hu/about-us/news/107-37-million-digitally-signed-documents-had-to-be-reverified
Third Party Advisory
https://www.search-lab.hu/eakta
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:microsec:e-szigno:*:*:*:*:*:*:*:*

Версия до 3.2 (включая)

EPSS

Процентиль: 57%

0.00355

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-91

Связанные уязвимости

GHSA-mpf7-m9x4-8pxw