CVE-2023-34205

CVSS 9.1 - CRITICAL

Description

In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).

Affected Products

Vendor	Product	Version
moov	signedxml	`1.0.0`

References

https://github.com/moov-io/signedxml/issues/23

Weakness Types

CWE-347 CWE-347

CVE Information

CVE ID:: CVE-2023-34205
Published:: 2023-05-30
Modified:: 2025-01-10
CVSS Score:: 9.1
Severity:: CRITICAL
Vector:: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Vendors

moov

Quick Actions

View on NVD Find Similar CVEs

CVSS Severity Scale

0.0 - 3.9 LOW

4.0 - 6.9 MEDIUM

7.0 - 8.9 HIGH

9.0 - 10.0 CRITICAL