CVE-2023-40178

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-40178
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-40178.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-40178
Aliases
Published
2023-08-23T20:15:23.057Z
Modified
2025-11-29T14:33:43.667323Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError
Details

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5.

Database specific 
{
    "cwe_ids": [
        "CWE-347"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40178.json"
}
References

Affected packages

Git / github.com/node-saml/node-saml

Affected ranges

Type
GIT
Repo
https://github.com/node-saml/node-saml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a2a20db585e614d703eff4f162b3e524afe00bde

Affected versions

0.*

0.0.3

v0.*

v0.1.0
v0.10.0
v0.11.0
v0.11.1
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.16.1
v0.16.2
v0.2.0
v0.2.1
v0.20.0
v0.20.1
v0.20.2
v0.3.0
v0.30.0
v0.31.0
v0.32.0
v0.32.1
v0.33.0
v0.34.0
v0.35.0
v0.4.0
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.6.0
v0.6.1
v0.6.2
v0.7.0
v0.8.0
v0.9.0
v0.9.1
v0.9.2

v1.*

v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.4.0
v1.4.1
v1.4.2
v1.5.0

v2.*

v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5

v3.*

v3.0.0

v4.*

v4.0.0
v4.0.0-beta.2
v4.0.0-beta.3
v4.0.0-beta.4
v4.0.0-beta.5
v4.0.0-beta.6
v4.0.1
v4.0.2
v4.0.3
v4.0.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-40178.json"