CVE-2022-24129

Published February 4th, 2022

View on NVD ↗

CVSS v3

8.2

HIGH

CVSS v2

6.4

MEDIUM

Affected

PROJECT

Description

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to interact with arbitrary third-party HTTP services.

sbaresearch/advisories

Security advisories by SBA Research.

GitHub