vulnerability
Red Hat JBoss EAP: CVE-2025-31335: Improper Verification of Cryptographic Signature
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:N/C:N/I:P/A:N) | Mar 28, 2025 | Apr 1, 2025 | Nov 26, 2025 |
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
Mar 28, 2025
Added
Apr 1, 2025
Modified
Nov 26, 2025
Description
The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures).. A flaw was found in the OpenSAML C++ library. This vulnerability allows forging signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures.
Solution
red-hat-jboss-eap-upgrade-latest
References
- CWE-347
- CVE-2025-31335
- https://attackerkb.com/topics/CVE-2025-31335
- URL-https://access.redhat.com/security/cve/CVE-2025-31335
- URL-https://bugzilla.redhat.com/show_bug.cgi?id=2355681
- URL-https://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=22a610b322e2178abd03e97cdbc8fb50b45efaee
- URL-https://lists.debian.org/debian-security-announce/2025/msg00041.html
- URL-https://shibboleth.atlassian.net/browse/CPPOST-126
- URL-https://shibboleth.net/community/advisories/secadv_20250313.txt
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.