Skip to main content

Saml CVE-2021-36786

HIGH
Insecure Storage of Sensitive Information (CWE-922)
2021-08-13 cve@mitre.org
Information Disclosure Saml
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Aug 13, 2021 - 17:15 nvd
HIGH 7.5

DescriptionNVD

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.

AnalysisAI

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-922. The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys. Affected products include: Miniorange Saml. Version information: before 1.4.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Saml

View all
CVE-2020-27846 CRITICAL POC
9.8 Dec 21

A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
CVE-2022-45597 CRITICAL
9.8 Mar 24

ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. Rated critical severity (CVSS 9.8), this vulnerability is
CVE-2023-29129 CRITICAL
9.8 Jun 13

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAM
CVE-2022-41912 CRITICAL
9.8 Nov 28

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML respon
CVE-2022-44457 CRITICAL
9.8 Nov 08

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7
CVE-2022-37011 CRITICAL
9.8 Sep 13

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8
CVE-2021-21678 HIGH
8.8 Aug 31

Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target
CVE-2021-33712 HIGH
8.8 Jun 08

A vulnerability has been identified in Mendix SAML Module (All versions < V2.1.2). Rated high severity (CVSS 8.8), this

CVE-2023-28119 HIGH
7.5 Mar 22

The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Rated high severity (CVSS

CVE-2023-25957 HIGH
7.5 Mar 14

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAM
CVE-2022-32285 HIGH
7.5 Jun 14

A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Mo
CVE-2023-45683 MEDIUM
6.1 Oct 16

github.com/crewjam/saml is a saml library for the go language. Rated medium severity (CVSS 6.1), this vulnerability is r

Same weakness CWE-922 – Insecure Storage of Sensitive Information

View all
CVE-2023-29727 CRITICAL POC
9.8
CVE-2021-27170 CRITICAL POC
9.8
CVE-2017-7253 HIGH POC
8.8
CVE-2025-28244 HIGH POC
8.8
CVE-2025-46627 HIGH POC
8.2
CVE-2024-22773 HIGH POC
8.1
CVE-2023-32184 HIGH POC
7.8
CVE-2023-29757 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2021-36786 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy