Service Provider vulnerabilities

2 known vulnerabilities in Service Provider from Shibboleth. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Service Provider: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-9943Sep 10, 2025Shibboleth

  An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this is

• 7.3 High severity

  Service Provider: Uncontrolled Search Path Element

  CVE-2023-22947Jan 11, 2023Shibboleth

  Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the ins