1. Home
  2. CVE Database
  3. CVE-2021-23365
MEDIUM · 4.8

CVE-2021-23365

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XM...

Vulnerability Description

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

CVSS Score

4.8

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
TykTyk-Identity-Broker< 1.1.1

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2021-23365?

CVE-2021-23365 is a vulnerability with a CVSS score of 4.8 (MEDIUM). The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XM...

How severe is CVE-2021-23365?

CVE-2021-23365 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-23365?

Check the references section above for vendor advisories and patch information. Affected products include: Tyk Tyk-Identity-Broker.