{"cve":"CVE-2024-47832","nvd":{"published":"2024-10-09T19:15:14.647","modified":"2026-06-17T07:57:50.150","status":"Analyzed","description":"ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-347"],"references":["https://github.com/ssoready/ssoready/commit/7f92a0630439972fcbefa8c7eafe8c144bd89915","https://github.com/ssoready/ssoready/security/advisories/GHSA-j2hr-q93x-gxvh","https://ssoready.com/docs/self-hosting/self-hosting-sso-ready"],"products":["ssoready:ssoready"],"source":"nvd","synced_at":"2026-10-19T21:55:31.737901711+00:00"},"epss":{"cve":"CVE-2024-47832","score":0.00401,"percentile":0.34415,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-j2hr-q93x-gxvh","url":"https://osv.dev/vulnerability/GHSA-j2hr-q93x-gxvh","summary":"SSOReady has an XML Signature Bypass via differential XML parsing","modified":"2024-10-11T16:58:37Z","packages":[{"ecosystem":"Go","name":"github.com/ssoready/ssoready","purl":"pkg:golang/github.com/ssoready/ssoready","ranges":["<0.0.0-20241009153838-7f92a0630439"],"fixed":["0.0.0-20241009153838-7f92a0630439"]}]},{"id":"GO-2024-3185","url":"https://osv.dev/vulnerability/GO-2024-3185","summary":"XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready","modified":"2026-03-03T04:55:52.350480Z","packages":[{"ecosystem":"Go","name":"github.com/ssoready/ssoready","purl":"pkg:golang/github.com/ssoready/ssoready","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}