CVE-2017-16853

8.1 HIGH
Published: November 16, 2017 Modified: May 13, 2026
View on NVD

Description

The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://www.securityfocus.com/bid/101898
Source: cve@mitre.org
Third Party Advisory VDB Entry
https://bugs.debian.org/881856
Source: cve@mitre.org
Issue Tracking Third Party Advisory
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d
Source: cve@mitre.org
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html
Source: cve@mitre.org
https://shibboleth.net/community/advisories/secadv_20171115.txt
Source: cve@mitre.org
Issue Tracking Vendor Advisory
https://www.debian.org/security/2017/dsa-4039
Source: cve@mitre.org
Issue Tracking Third Party Advisory
http://www.securityfocus.com/bid/101898
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory VDB Entry
https://bugs.debian.org/881856
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking Third Party Advisory
https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html
Source: af854a3a-2127-422b-91ae-364da2661108
https://shibboleth.net/community/advisories/secadv_20171115.txt
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking Vendor Advisory
https://www.debian.org/security/2017/dsa-4039
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking Third Party Advisory

12 reference(s) from NVD

Quick Stats

CVSS v3 Score
8.1 / 10.0
EPSS (Exploit Probability)
0.7%
72th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-347

Affected Vendors

debian shibboleth

Related CVEs

CVE-2026-8654 N/A
CVE-2026-6646 6.4
CVE-2026-4094 8.1
CVE-2026-41702 7.8
CVE-2026-43490 N/A