{"id":"CVE-2020-5407","aliases":["EUVD-2020-0457","GHSA-48rw-j489-928m"],"status":"published","title":"Signature Wrapping Vulnerability with spring-security-saml2-service-provider","description":"Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01199,"percentile":0.68366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2020-05-13T17:00:15Z","modified":"2026-06-17T03:21:26Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","fixed_in":["5.2.4","5.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}],"versions":["5.2.0.RELEASE","5.2.1.RELEASE","5.2.2.RELEASE","5.2.3.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.2"}]}],"versions":["5.3.0.RELEASE","5.3.1.RELEASE"]}],"products":[{"vendor":"pivotal_software","product":"spring_security"},{"vendor":"spring","product":"spring security"},{"vendor":"spring by vmware","product":"spring security"}],"references":[{"url":"https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://tanzu.vmware.com/security/cve-2020-5407","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5407","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7@%3Cissues.servicemix.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a@%3Cdev.geode.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c@%3Cdev.geode.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-48rw-j489-928m"}],"sources":{"cve":[{"id":"CVE-2020-5407","title":"Signature Wrapping Vulnerability with spring-security-saml2-service-provider","description":"Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.","status":"published","published":"2020-05-13T17:00:15.881Z","modified":"2024-09-16T23:56:17.066Z","cwes":["CWE-347"],"updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-0457","description":"Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.","status":"published","published":"2020-05-13T17:00:15Z","modified":"2024-09-16T23:56:17Z","updated_at":"2026-11-03T00:29:03.911526Z"}],"ghsa":[{"id":"GHSA-48rw-j489-928m","title":"Signature wrapping vulnerability in Spring Security","description":"Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.","status":"published","published":"2020-06-05T16:13:29Z","modified":"2023-02-01T05:03:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2020-5407","description":"Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.","status":"published","published":"2020-05-13T17:15:11.967Z","modified":"2026-06-17T03:21:26.19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"GHSA-48rw-j489-928m","title":"Signature wrapping vulnerability in Spring Security","description":"Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.","status":"published","published":"2020-06-05T16:13:29Z","modified":"2023-11-08T04:03:55.226562Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}