CVE-2020-5261 High · 8.2 EPSS 1.5%

Missing Token Replay Detection

Sustainsys · Saml2

Official description · CVE.org

Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use.

Breakdown

20.6 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Capture network trafficT1040 · Network SniffingSource data9 general detection rules
What they do
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource data149 general detection rules

Disclosed on 25 Mar 2020. No public exploit code or confirmed exploitation is recorded.

3 fixes in Sustainsys.Saml2 over 3 years. The latest fix listed for Sustainsys.Saml2 is 2.9.2.

Fixes in Sustainsys.Saml2NuGet package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2.5.0CVE-2020-526125 Mar 2020
2.7.0CVE-2020-526821 Apr 2020
2.9.2CVE-2023-4189019 Sep 2023Latest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Exploit Public-Facing Application T1190

MITRE CTID mapping of the CVE · primary impact

Credential AccessTA0006

Network Sniffing T1040 also Discovery

MITRE CTID mapping of the CVE · how it is exploited

Detection

0 rules for this CVE · 158 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-5261 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Network SniffingT10409 general rules

Cisco Sniffingmediumtest
Harvesting Of Wifi Credentials Via Netsh.EXEmediumtest
New Network Trace Capture Started Via Netsh.EXEmediumtest
PktMon.EXE Executionmediumtest
Potential Network Sniffing Activity Using Network Toolsmediumtest
Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlockmediumtest
Windows Pcap Driversmediumtest
Network Sniffing - Linuxlowtest

All 9 on SigmaHQ ↗

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: Sustainsys.Saml2.

NuGetSustainsys.Saml2GHSA-g6j2-ch25-5mmv

Upgrade to 2.5.0 or later

Set the version to 2.5.0 or later in your .csproj.

The first fix for CVE-2020-5261. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you run	Upgrade to
2.0.0 up to 2.5.0	2.5.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv

x_refsource_MISC 2

github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241 github.com/Sustainsys/Saml2/issues/711

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2020-0344

No public exploit code found.

, 30 Oct 2026

1.5%Top 26%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 74.2%).

3.1

8.2High · 8.2

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.7416 14.8/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 8.2 5.7/7

End-of-life productsupported or unknown 0.0

Total20.6

Record

Published: 25 Mar 2020
Modified: 4 Aug 2024
: CWE-294 Authentication Bypass by Capture-replay
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.