Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.

Affected: Ubuntu:20.04:LTS: shibboleth-sp

Toni Huttunen and Fraktal Oy discovered that the Shibboleth Service provider allowed content injection due to allowing attacker-controlled parameters in error or other status pages. An attacker could use this to inject malicious content.