{"action":"Upgrade node-saml to 4.0.0-beta.5 or later.","affected":[{"fixed":"4.0.0-beta.5","introduced":"0"}],"component":"node-saml","cve_ids":["CVE-2022-39299"],"ecosystem":"npm","epss":0.04494,"exploited":false,"fixed_versions":["4.0.0-beta.5"],"ghsa_id":"GHSA-m974-647v-whv7","id":"tcs_01M5KG0APB0C29ME5Z3CXT8BKZ","modified_at":"2023-11-08T04:10:18.208725Z","published_at":"2022-10-12T22:05:41Z","references":["https://osv.dev/vulnerability/GHSA-m974-647v-whv7","https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7","https://nvd.nist.gov/vuln/detail/CVE-2022-39299","https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e","https://github.com/node-saml/passport-saml","https://github.com/node-saml/passport-saml/releases/tag/v3.2.2","http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-m974-647v-whv7#npm/node-saml","url":"https://osv.dev/vulnerability/GHSA-m974-647v-whv7"}],"summary":"Signature bypass via multiple root elements"}