Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt (rather than C:\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that "We consider the ACLs a best effort thing" and "it was a documentation mistake."
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Shibboleth 代码问题漏洞
Vulnerability Description
Shibboleth是英国Shibboleth公司的一套基于Windows平台的开源的SAML协议的Web单点登录系统。 Shibboleth Service Provider (SP) Windows 3.4.1 之前版本存在安全漏洞，该漏洞源于安装默认位于 C:opt（而不是 C:Program Files）下，安装路径中的不安全文件夹权限允许无特权的本地攻击者通过在服务可执行文件的文件夹中植入 DLL 将特权升级到 SYSTEM。
CVSS Information
N/A
Vulnerability Type
N/A