Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:34:48 +0000 CVE-2024-41107 — Apache CloudStack: SAML Signature Exclusion https://cve.radiocsirt.org/vuln/cve-2024-41107 <p><strong>Affected:</strong> Apache Software Foundation Apache CloudStack, apache_software_foundation apache_cloudstack</p> <p>The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account.</p> <p>Affected users are recommended to disable the SAML authentication plugin by setting the &#34;saml2.enabled&#34; global setting to &#34;false&#34;, or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache CloudStack, apache_software_foundation apache_cloudstack</p> <p>The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account.</p> <p>Affected users are recommended to disable the SAML authentication plugin by setting the &#34;saml2.enabled&#34; global setting to &#34;false&#34;, or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.</p> https://cve.radiocsirt.org/vuln/cve-2024-41107