一、 漏洞 CVE-2020-5268 基础信息
漏洞标题
ASP.NET中的SAML2身份验证服务未验证主题确认方法
来源：AIGC 神龙大模型
漏洞描述信息
ASP.NET中的Saml2身份验证服务未验证主题确认方法
来源：AIGC 神龙大模型
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
来源：AIGC 神龙大模型
漏洞类别
N/A
来源：AIGC 神龙大模型
漏洞标题
Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET
来源：美国国家漏洞数据库 NVD
漏洞描述信息
In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is also support in the Saml2 protocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private key must be proved. The Sustainsys.Saml2 library incorrectly treats all incoming tokens as bearer tokens, even though they have another subject confirmation method specified. This could be used by an attacker that could get access to Saml2 tokens with another subject confirmation method than bearer. The attacker could then use such a token to create a log in session. This vulnerability is patched in versions 1.0.2 and 2.7.0.
来源：美国国家漏洞数据库 NVD
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
来源：美国国家漏洞数据库 NVD
漏洞类别
认证算法的不正确实现
来源：美国国家漏洞数据库 NVD
漏洞标题
Saml2 Authentication services for ASP.NET 授权问题漏洞
来源：中国国家信息安全漏洞库 CNNVD
漏洞描述信息
Saml2 Authentication services for ASP.NET是一款用于ASP.NET的SAML（安全声明标记语言）身份验证服务。 Saml2 Authentication services for ASP.NET 1.0.2版本和2.0.0版本至2.6.0版本中令牌验证的方法存在安全漏洞。攻击者可利用该漏洞创建登录会话。
来源：中国国家信息安全漏洞库 CNNVD
CVSS信息
N/A
来源：中国国家信息安全漏洞库 CNNVD
漏洞类别
授权问题
来源：中国国家信息安全漏洞库 CNNVD
二、漏洞 CVE-2020-5268 的公开POC
# POC 描述 源链接 神龙链接
三、漏洞 CVE-2020-5268 的情报信息