{"id":"CVE-2017-1000452","details":"An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.","aliases":["GHSA-8jjf-w7j6-323c"],"modified":"2026-04-10T03:54:39.348529Z","published":"2018-01-02T17:29:00.697Z","references":[{"type":"ADVISORY","url":"https://www.whitehats.nl/blog/xml-signature-wrapping-samlify"},{"type":"FIX","url":"https://github.com/tngan/samlify/releases/tag/v2.3.0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tngan/samlify","events":[{"introduced":"0"},{"last_affected":"eae5b0b44ab57af9f61c44cafaea95f6a3a8d50c"},{"fixed":"1371ff7e1b82e59fb3d5786fd0f76880ef356786"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"2.2.0"}]}}],"versions":["v1.0.0","v1.1.0","v1.1.3","v1.1.5","v1.2","v1.2.1","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v2.0.0","v2.0.0-alpha","v2.0.0-beta","v2.0.0-rc.1","v2.0.0-rc.2","v2.0.0-rc.3","v2.0.1","v2.0.1-rc.3","v2.0.2","v2.0.3","v2.0.4","v2.1.0","v2.1.1","v2.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000452.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}