{"id":"CVE-2023-36661","details":"Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)","modified":"2026-03-13T07:39:32.276655Z","published":"2023-06-25T22:15:21.403Z","related":["SUSE-SU-2023:2766-1","SUSE-SU-2023:2975-1","SUSE-SU-2023:3089-1"],"references":[{"type":"ADVISORY","url":"https://shibboleth.net/community/advisories/secadv_20230612.txt"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5432"}],"affected":[{"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"fixed":"3.2.4"}]},{"events":[{"introduced":"0"},{"last_affected":"11.0"}]},{"events":[{"introduced":"0"},{"last_affected":"12.0"}]}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-36661.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}