High severity7.5NVD Advisory· Published Jun 4, 2021· Updated Jun 17, 2026
CVE-2021-33054
CVE-2021-33054
Description
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- SOGo/SOGodescription
Patches
Vulnerability mechanics
References
5- blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.htmlnvdThird Party Advisory
- github.com/inverse-inc/sogo/blob/master/CHANGELOG.mdnvdRelease NotesThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/07/msg00007.htmlnvdMailing ListThird Party Advisory
- www.debian.org/security/2021/dsa-5029nvdThird Party Advisory
- www.sogo.nu/news.htmlnvdProduct
News mentions
0No linked articles in our index yet.