CVE-2013-2279

CA SiteMinder Federation (FSS) 12.5, 12.0, and r6; Federation (Standalone) 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain privileges.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2013-03-21

Last modified

2024-09-17

Weaknesses

CWE-20

Affected products

• 2010 (Siteminder Agent For Sharepoint)
• 12.0 (Siteminder Federation)
• 12.1 (Siteminder Federation)
• 12.5 (Siteminder Federation)
• R6.0 (Siteminder Federation)
• 12.0 (Siteminder For Secure Proxy Server)
• 12.5 (Siteminder For Secure Proxy Server)
• 6.0 (Siteminder For Secure Proxy Server)

References

• http://archives.neohapsis.com/archives/bugtraq/2013-03/0118.html
• http://secunia.com/advisories/52610
• http://www.securityfocus.com/bid/58609
• https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B53E50CBD-6F6A-4B3A-85FF-36E44ABED8D5%7D