{"cve":"CVE-2009-3474","nvd":{"published":"2009-09-29T23:30:00.217","modified":"2026-06-16T23:11:40.580","status":"Modified","description":"OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-310"],"references":["http://secunia.com/advisories/36855","http://secunia.com/advisories/36868","http://secunia.com/advisories/36876","http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt","http://www.debian.org/security/2009/dsa-1895"],"products":["internet2:opensaml","internet2:shibboleth-sp","internet2:xmltooling"],"source":"nvd","synced_at":"2026-10-19T19:54:26.868835795+00:00"},"epss":{"cve":"CVE-2009-3474","score":0.01544,"percentile":0.7498,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}