CVE-2024-47832

Summary

CVE-2024-47832 is a newly disclosed vulnerability affecting the ssoready Single Sign On provider, which is implemented via Docker. This issue allows for XML signature bypass attacks against versions that are vulnerable. An attacker can potentially carry out signature bypass if they have access to specific IDP-signed messages. The root cause of the vulnerability lies in the differential behavior between various XML parsers. The public instance of SSOReady hosted at <https://ssoready.com> is not impacted by this issue. Those self-hosting SSOReady are advised to upgrade to version 7f92a06 or later to mitigate the risk. This can be achieved by updating the corresponding Docker images. At present, there are no known workarounds for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.