Skip to content
Fencer Intel
no cvss —

DRUPAL-CONTRIB-2021-006 json

The [SAML Authentication module](https://www.drupal.org/project/samlauth) allows users to authenticate against a SAML identity provider to…

published 5y ago modified 2mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The [SAML Authentication module](https://www.drupal.org/project/samlauth) allows users to authenticate against a SAML identity provider to login to your Drupal site.

The module doesn't sufficiently protect against unauthorized local access, by way of using the 'password reset' facility, for users who are supposed to only be able to log in through the identity provider. This creates a scenario where after such a user is blocked from logging in through the identity provider but not explicitly blocked in Drupal, they are still able to log in by sending themselves a Drupal 'password reset' e-mail.

Patch / fix

  • packagist drupal/samlauth 3.1.0

Is DRUPAL-CONTRIB-2021-006 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist drupal/samlauth
<3.1.0
3.1.0

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.