CVE-2015-3932

Опубликовано: 21 июл. 2017

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.

Ссылки

http://packetstormsecurity.com/files/132473/Microsec-e-Szigno-Netlock-Mokka-XML-Signature-Wrapping.html
Third Party Advisory
VDB Entry
http://www.neih.gov.hu/?q=node/66
Third Party Advisory
http://www.securityfocus.com/bid/75489
Third Party Advisory
VDB Entry
https://www.search-lab.hu/about-us/news/107-37-million-digitally-signed-documents-had-to-be-reverified
Third Party Advisory
https://www.search-lab.hu/eakta
Third Party Advisory
http://packetstormsecurity.com/files/132473/Microsec-e-Szigno-Netlock-Mokka-XML-Signature-Wrapping.html
Third Party Advisory
VDB Entry
http://www.neih.gov.hu/?q=node/66
Third Party Advisory
http://www.securityfocus.com/bid/75489
Third Party Advisory
VDB Entry
https://www.search-lab.hu/about-us/news/107-37-million-digitally-signed-documents-had-to-be-reverified
Third Party Advisory
https://www.search-lab.hu/eakta
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:netlock:mokka:*:*:*:*:*:*:*:*

Версия до 2.7 (включая)

EPSS

Процентиль: 61%

0.00411

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-91

Связанные уязвимости

GHSA-r3cj-f3m2-c2xj