CVE-2022-24129

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to interact with arbitrary third-party HTTP services.

• CWE-918

• http://shibboleth.net/community/advisories/Vendor Advisory
• http://shibboleth.net/community/advisories/secadv_20220131.txtVendor Advisory
• https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220127-01_Shibboleth_IdP_OIDC_OP_Plugin_SSRFExploit, Third Party Advisory
• http://shibboleth.net/community/advisories/Vendor Advisory
• http://shibboleth.net/community/advisories/secadv_20220131.txtVendor Advisory
• https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220127-01_Shibboleth_IdP_OIDC_OP_Plugin_SSRFExploit, Third Party Advisory

Published

Feb 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24123MarkText through 0.16.3 does not sanitize the input of a mer…9
• CVE-2022-24124The query API in Casdoor before 1.13.1 has a SQL injection v…7.5
• CVE-2022-24125The matchmaking servers of Bandai Namco FromSoftware Dark So…8.8
• CVE-2022-24126A buffer overflow in the NRSessionSearchResult parser in Ban…9.8
• CVE-2022-24127A Stored Cross-Site Scripting (XSS) vulnerability was discov…5.4
• CVE-2022-24128Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow pri…8
• CVE-2022-2413The Slide Anything WordPress plugin before 2.3.47 does not p…5.4
• CVE-2022-24130xterm through Patch 370, when Sixel support is enabled, allo…5.5
• CVE-2022-24131DouPHP v1.6 Release 20220121 is affected by Cross Site Scrip…6.1
• CVE-2022-24132phpshe V1.8 is affected by a denial of service (DoS) attack …7.5
• CVE-2022-24135QingScan 1.3.0 is affected by Cross Site Scripting (XSS) vul…6.1
• CVE-2022-24136Hospital Management System v1.0 is affected by an unrestrict…9.8