CVE-2023-34205
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In Moov signedxml through 1.0.0, parsing the raw XML can result in different output than parsing the canonicalized XML. This allows for bypassing signature validation via a Signature Wrapping attack (XSW).
Risk Assessment
The organization may be vulnerable to attacks that allow signature forgery, potentially leading to unauthorized access or data manipulation.
Recommendation
It is recommended to upgrade to the latest version of Moov signedxml to mitigate this vulnerability and implement additional signature verification mechanisms.
Original NVD description (English source)
In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).