VDB
CVE-2021-33054
CVE-2021-33054
PUBLISHED
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
EPSS 0.12% · 30.5th percentile
Risk Scores
EPSS Score
0.12%
30.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | sogo | 0, 3.2.10-1build1, 3.2.10-1 |
| Ubuntu:16.04:LTS | sogo | 0, 2.2.17a-1.1, * |
| Ubuntu:25.10 | sogo | 5.12.1-3, 5.11.2-4, 5.12.1-1 |
| Ubuntu:20.04:LTS | sogo | 0, 4.3.0-1, 4.0.8-1 |
| Ubuntu:22.04:LTS | sogo | 5.3.0-1build2, 5.4.0-1, 5.3.0-1 |
Exploit Intelligence
- https://www.sogo.nu/news.html (circl)
- https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md (circl)
- https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html (circl)
- [debian-lts-announce] 20210712 [SECURITY] [DLA 2707-1] sogo security update (circl)
- DSA-5029 (circl)
Timeline
- Jun 4, 2021 CVE Published
- Jun 5, 2021 EPSS Score
- Aug 7, 2021 EPSS Score
- Oct 7, 2021 EPSS Score
- Dec 7, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 6, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Apr 8, 2022 EPSS Score
- Jun 8, 2022 EPSS Score
- Aug 9, 2022 EPSS Score
- Oct 8, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2021-33054 third-party-advisory
- https://www.sogo.nu/news/2021/saml-vulnerability.html third-party-advisory
- https://blogs.akamai.com/2021/06/saml-implementation-vulnerability-impacting-some-akamai-services.html third-party-advisory
- https://blogs.akamai.com/2021/06/akamai-eaa-impersonation-vulnerability---a-deep-dive.html third-party-advisory
- https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.html third-party-advisory
- https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.md third-party-advisory
- https://www.sogo.nu/news.html third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-33054 third-party-advisory