Sitevision Auto-Generated Password Vulnerability Lets Hackers Steal Signing Key

Summary: A critical vulnerability identified in Sitevision CMS (versions 10.3.1 and earlier) allows attackers to extract private keys for SAML authentication due to a weakly protected Java keystore accessible via WebDAV. This flaw, tracked as CVE-2022-35202, potentially enables unauthorized access to authenticated user sessions. Sitevision released a patch in version 10.3.2 to address the issue, but existing installations remain at risk unless passwords are manually rotated.

Affected: Sitevision CMS (versions 10.3.1 and earlier)

Keypoints :

• Vulnerability allows extraction of private keys for SAML authentication requests through a weakly protected Java keystore.
• Attackers can potentially redirect authentication tokens to malicious endpoints, compromising user sessions.
• Sitevision released a patch in version 10.3.2, but manual password rotation is required for existing installations to close the vulnerability.