{"action":"Upgrade github.com/fleetdm/fleet/v4 to 4.9.1 or later.","affected":[{"fixed":"4.9.1","introduced":"0"}],"component":"github.com/fleetdm/fleet/v4","cve_ids":["CVE-2022-23600"],"ecosystem":"Go","epss":0.00893,"exploited":false,"fixed_versions":["4.9.1"],"ghsa_id":"GHSA-ch68-7cf4-35vr","id":"tcs_01M5KF7AEERSVBTK42ZW8NVNJ3","modified_at":"2023-11-08T04:08:24.640117Z","published_at":"2022-02-07T21:57:38Z","references":["https://osv.dev/vulnerability/GHSA-ch68-7cf4-35vr","https://github.com/fleetdm/fleet/security/advisories/GHSA-ch68-7cf4-35vr","https://nvd.nist.gov/vuln/detail/CVE-2022-23600","https://github.com/fleetdm/fleet/commit/35d5a7b285f15ddd47486fa656e8b1acf3d48374","https://github.com/fleetdm/fleet"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-ch68-7cf4-35vr","url":"https://osv.dev/vulnerability/GHSA-ch68-7cf4-35vr"}],"summary":"Limited ability to spoof SAML authentication with missing audience verification in Fleet"}