Vulnerabilities > CVE-2022-24129 - Server-Side Request Forgery (SSRF) vulnerability in Shibboleth Oidc OP
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
NONE Summary
The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to interact with arbitrary third-party HTTP services.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |