{"id":"CVE-2021-33054","aliases":["DEBIAN-CVE-2021-33054","DLA-2707-1","DSA-5029-1","EUVD-2021-19769","GHSA-5x58-gqg4-wfvq","MGASA-2022-0481","UBUNTU-CVE-2021-33054","USN-8504-1"],"status":"published","title":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any...","description":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00995,"percentile":0.63105,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2021-06-04T14:40:15Z","modified":"2026-10-23T18:03:14Z","fixes":[{"ecosystem":"Debian:12","package":"sogo","fixed_in":["5.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sogo","fixed_in":["5.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"sogo","fixed_in":["3.2.6-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"sogo","fixed_in":["4.0.7-1+deb10u2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"sogo","fixed_in":["5.0.1-4+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"sogo","fixed_in":["5.6.0-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"sope","fixed_in":["5.6.0-1.1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sogo","fixed_in":["2.2.17a-1.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"sogo","fixed_in":["3.2.10-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"sogo","fixed_in":["4.3.0-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-2+deb9u1"}]}],"versions":["3.2.6-2"]},{"source":"osv","ecosystem":"Debian:10","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-1+deb10u2"}]}],"versions":["4.0.7-1","4.0.7-1+deb10u1"]},{"source":"osv","ecosystem":"Debian:11","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-4+deb11u1"}]}],"versions":["5.0.1-4"]},{"source":"osv","ecosystem":"Mageia:8","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"sope","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.17a-1.1ubuntu0.1~esm1"}]}],"versions":["2.2.17a-1","2.2.17a-1.1","2.2.17a-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-1ubuntu0.1~esm1"}]}],"versions":["3.2.10-1","3.2.10-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1ubuntu0.1~esm1"}]}],"versions":["4.0.8-1","4.1.0-1","4.1.1-1","4.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.17a-1.1ubuntu0.1~esm1"}]}],"versions":["2.2.17a-1","2.2.17a-1.1","2.2.17a-1.1build1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-1ubuntu0.1~esm1"}]}],"versions":["3.2.10-1","3.2.10-1build1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1ubuntu0.1~esm1"}]}],"versions":["4.0.8-1","4.1.0-1","4.1.1-1","4.3.0-1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.1-1ubuntu0.1~esm1"}]}],"versions":["5.1.0-1","5.2.0-1","5.2.0-3","5.3.0-1","5.3.0-1build2","5.4.0-1","5.5.0-1","5.5.1-1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.4-1.2ubuntu0.1~esm1"}]}],"versions":["5.12.1-3","5.12.4-1","5.12.4-1.1","5.12.4-1.2"],"bundled":11}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"inverse","product":"sogo"}],"references":[{"url":"https://www.sogo.nu/news.html","tags":["x_refsource_MISC","x_transferred","Product","web","report"]},{"url":"https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-5029","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33054"},{"url":"https://github.com/advisories/GHSA-5x58-gqg4-wfvq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-33054","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0481.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29255","tags":["report"]},{"url":"https://www.debian.org/lts/security/2021/dla-2707","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-33054","tags":["report"]},{"url":"https://www.sogo.nu/news/2021/saml-vulnerability.html","tags":["report"]},{"url":"https://blogs.akamai.com/2021/06/saml-implementation-vulnerability-impacting-some-akamai-services.html","tags":["report"]},{"url":"https://blogs.akamai.com/2021/06/akamai-eaa-impersonation-vulnerability---a-deep-dive.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33054","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8504-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-34462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-63498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-63499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-3054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46446","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-33054","description":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)","status":"published","published":"2021-06-04T14:40:15Z","modified":"2024-08-03T23:42:19.503Z","updated_at":"2026-11-02T14:33:10.555814Z"}],"euvd":[{"id":"EUVD-2021-19769","description":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)","status":"published","published":"2021-06-04T14:40:15Z","modified":"2024-08-03T23:42:19Z","updated_at":"2026-11-03T03:24:35.30045Z"}],"ghsa":[{"id":"GHSA-5x58-gqg4-wfvq","title":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any...","description":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)","status":"published","published":"2022-05-24T19:04:06Z","modified":"2023-01-29T05:06:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:46:01.439998Z"}],"nvd":[{"id":"CVE-2021-33054","description":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)","status":"published","published":"2021-06-04T15:15:07.647Z","modified":"2026-06-17T03:54:04.343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"CVE-2021-33054","description":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)","status":"published","published":"2021-06-04T15:15:07.647Z","modified":"2026-10-20T10:53:46.738803396Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-33054","description":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)","status":"published","published":"2021-06-04T15:15:07.647Z","modified":"2026-10-23T18:03:14.790744479Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"UBUNTU-CVE-2021-33054","description":"SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)","status":"published","published":"2021-06-04T15:15:00Z","modified":"2026-07-06T20:30:41.815247674Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"DLA-2707-1","title":"sogo - security update","status":"published","published":"2021-07-12T00:00:00Z","modified":"2026-03-09T01:22:31.665082Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-5029-1","title":"sogo - security update","status":"published","published":"2021-12-22T00:00:00Z","modified":"2026-03-09T02:10:31.658495Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0481","title":"Updated sogo packages fix security vulnerability","description":"Missing SAML signature validation in the SOGo groupware could result in\nimpersonation attacks. (CVE-2021-33054)\n","status":"published","published":"2022-12-30T22:39:00Z","modified":"2026-04-16T04:43:25.449121911Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-8504-1","title":"sogo vulnerabilities","description":"It was discovered that SOGo did not properly sanitize categories used\nfor events, tasks, and contacts. A remote authenticated attacker could\npossibly use this issue to perform cross-site scripting attacks. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04\nLTS, and Ubuntu 26.04 LTS. (CVE-2025-71276)\n\nIt was discovered that SOGo did not properly sanitize the hint query\nparameter. A remote attacker could possibly use this issue to perform\ncross-site scripting attacks. This issue only affected Ubuntu 26.04\nLTS. (CVE-2026-3054)\n\nIt was discovered that SOGo did not renew the one-time password when a\nuser disabled and re-enabled it, and used a shorter length than\nrecommended. A remote attacker could possibly use this issue to bypass\nauthentication. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n26.04 LTS. (CVE-2026-33550)\n\nIt was discovered that SOGo did not properly use the SQL adaptor for\nthe user source, resulting in SQL injection when certain databases\nwere used. A remote authenticated attacker could possibly use this\nissue to obtain sensitive information or execute arbitrary SQL\ncommands. (CVE-2026-46445, CVE-2026-46446)\n\nIt was discovered that SOGo did not properly sanitize mail containing\nICS calendar invitations. A remote attacker could possibly use this\nissue to perform cross-site scripting attacks. This issue only\naffected Ubuntu 26.04 LTS. (CVE-2026-8496)\n\nIt was discovered that SOGo did not properly validate identifiers when\nmanaging access control lists. A remote authenticated attacker could\npossibly use this issue to perform SQL injection attacks and obtain\nsensitive information. (CVE-2026-8851)\n\nIt was discovered that SOGo did not properly sanitize the theme\nparameter. A remote attacker could possibly use this issue to perform\ncross-site scripting attacks. This issue only affected Ubuntu 18.04\nLTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-63499)\n\nIt was discovered that SOGo did not properly sanitize the userName\nparameter on the login page. A remote attacker could possibly use this\nissue to perform cross-site scripting attacks. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\nUbuntu 22.04 LTS. (CVE-2025-63498)\n\nIt was discovered that SOGo did not properly sanitize attachments when\npreviewing them. A remote attacker could possibly use this issue to\nperform cross-site scripting attacks. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2024-34462)\n\nIt was discovered that SOGo did not validate the signatures of SAML\nassertions it received when SAML was used for authentication. A remote\nattacker could possibly use this issue to impersonate other users.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and\nUbuntu 20.04 LTS. (CVE-2021-33054)","status":"published","published":"2026-07-05T23:01:31Z","modified":"2026-07-06T20:44:29.515784604Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}