fusionauth records
4 published records for vendor fusionauth.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 25%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-347 Improper Verification of Cryptographic Signature1
- CWE-611 Improper Restriction of XML External Entity Reference1
- CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
4 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
37Monitor | CVE-2020-12676No exploit | FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Sigfusionauth · samlv2 · CWE-347 | Critical9.1 | — | 2.9% | Oct 2, 2020 |
34Monitor | CVE-2020-7799Proof of concept | An issue was discovered in FusionAuth before 1.11.0.fusionauth · fusionauth · CWE-917 | High7.2 | — | 19.8% | Jan 28, 2020 |
30Monitor | CVE-2022-45921No exploit | FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request.fusionauth · fusionauth · CWE-22 | High7.5 | — | 0.7% | Nov 28, 2022 |
26Monitor | CVE-2021-27736No exploit | FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xmfusionauth · saml v2 · CWE-611 | Medium6.5 | — | 1.3% | Apr 22, 2021 |
- CVE-2020-1267637Monitor
FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Sig
CriticalCVSS 9.1No exploitEPSS 3%fusionauth · samlv2Oct 2, 2020
- CVE-2020-779934Monitor
An issue was discovered in FusionAuth before 1.11.0.
HighCVSS 7.2Proof of conceptEPSS 20%fusionauth · fusionauthJan 28, 2020
- CVE-2022-4592130Monitor
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request.
HighCVSS 7.5No exploitEPSS 1%fusionauth · fusionauthNov 28, 2022
- CVE-2021-2773626Monitor
FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xm
MediumCVSS 6.5No exploitEPSS 1%fusionauth · saml v2Apr 22, 2021