A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."
CVSS Details
- CVSS 3.0 Base Score: 9.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp2 | — | Upgrade ipsilon-personaUpgrade ipsilon-filesystemUpgrade ipsilon-clientUpgrade ipsilon-tools-ipaUpgrade ipsilon-baseUpgrade ipsilon-saml2-baseUpgrade ipsilon-authgssapiUpgrade ipsilon-infosssdUpgrade ipsilonUpgrade ipsilon-saml2Upgrade ipsilon-authldapUpgrade ipsilon-authform | Jan 19, 2018 | Jul 12, 2017 |
| Oracle_linux | — | Upgrade ipsilon-tools-ipaUpgrade ipsilon-saml2Upgrade ipsilonUpgrade ipsilon-filesystemUpgrade ipsilon-saml2-baseUpgrade ipsilon-authldapUpgrade ipsilon-infosssdUpgrade ipsilon-clientUpgrade ipsilon-authformUpgrade ipsilon-baseUpgrade ipsilon-authgssapiUpgrade ipsilon-persona | Nov 21, 2016 | Nov 21, 2016 |
| Redhat_linux | — | Upgrade ipsilon-baseUpgrade ipsilon-infosssdUpgrade ipsilonUpgrade ipsilon-saml2Upgrade ipsilon-authgssapiUpgrade ipsilon-filesystemUpgrade ipsilon-personaUpgrade ipsilon-clientUpgrade ipsilon-authldapUpgrade ipsilon-tools-ipaUpgrade ipsilon-saml2-baseUpgrade ipsilon-authform | Nov 21, 2016 | Nov 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub