CVE-2011-1411
Improper Authentication in OpenSAML
CVE-2011-1411 is a medium vulnerability (CVSS 5.8) in Shibboleth Opensaml, published July 25, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in org.opensaml:opensaml 2.4.3.
- Severity
- 5.8 MediumCVSS 2.0, NVD
- Exploit chance
- 2.29%EPSS, 83rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.4.3org.opensaml:opensaml +4 more
Description
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opensaml:opensamlMaven | 2.4.0 up to 2.4.3 | 2.4.3 |
org.opensaml:opensamlMaven | 2.5.0 up to 2.5.1 | 2.5.1 |
opensaml2Debian:6.0 | before 2.3-2+squeeze1, plus listed versions 2.3-22.3-2+squeeze1~bpo50+1 | 2.3-2+squeeze1 |
opensaml2Debian:5.0 | before 2.0-2+lenny3, plus listed versions 2.0-22.0-2+lenny12.0-2+lenny2 | 2.0-2+lenny3 |
org.opensaml:opensamlMaven | 2.4.0 up to 2.4.3, plus listed versions 2.4.1 | 2.4.3 |
What each source reports
NVD Score used
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
- Record
CVE-2011-1411- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE ListNo score
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
- Record
CVE-2011-1411- Updated
- 2026-11-02
EUVDEUVD-2022-5052No score
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
- Record
EUVD-2022-5052- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qwwj-qj3f-9hv7No score
Improper Authentication in OpenSAML
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
- Record
GHSA-qwwj-qj3f-9hv7- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-qwwj-qj3f-9hv7No score
Improper Authentication in OpenSAML
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
- Record
GHSA-qwwj-qj3f-9hv7- Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
shibboleth.internet2.edu/secadv/secadv_20110725.txt
debian.org/security/2011/dsa-2284
secunia.com/advisories/50994
oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
mandriva.com/security/advisories?name=MDVSA-2013:150
nvd.nist.gov/vuln/detail/CVE-2011-1411
github.com/advisories/GHSA-qwwj-qj3f-9hv7