CVE-2022-45597

CriticalCVSS 9.8

Published: 24/03/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

37th percentile - higher than 37% of all known CVEs

Summary

The vulnerability in ComponentSpace.Saml2 4.4.0 is missing SSL certificate validation. The vendor does not consider this a vulnerability because certificates are exchanged in a controlled manner within trust relationships, and validation at the application layer is less critical than at the transport layer.

Risk Assessment

Missing certificate validation could allow an attacker to impersonate a trusted party during SAML authentication, leading to identity theft or unauthorized access to systems.

Recommendation

Upgrade to a newer version of ComponentSpace.Saml2 that implements certificate validation, or manually enforce certificate verification in the application.

Original NVD description (English source)

ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. NOTE: the vendor does not consider this a vulnerability because the report is only about use of certificates at the application layer (not the transport layer) and "Certificates are exchanged in a controlled fashion between entities within a trust relationship. This is why self-signed certificates may be used and why validating certificates isn’t as important as doing so for the transport layer certificates."