Improper Verification of Cryptographic Signature in xml-crypto - CVE-2025-29775
Published: June 27, 2025
Vulnerability identifier: #VU111985
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-29775
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to authentication or authorization bypass in systems that rely on xml-crypto for verifying signed XML documents. A remote attacker can bypass authentication or authorization mechanisms and modify a valid signed XML message in a way that still passes signature verification checks.
Affected software
xml-crypto
IBM Cloud Pak for Watson AIOps
Telco Unified OSS Console
IBM Cloud Pak for Multicloud Management
IBM Cloud Pak for Watson AIOps
Telco Unified OSS Console
IBM Cloud Pak for Multicloud Management
How to mitigate CVE-2025-29775
Install updates from vendor's website.
xml-crypto - addressed in versions 2.1.6, 3.2.1, 6.0.1
IBM Cloud Pak for Watson AIOps - update to 4.10.0
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
Telco Unified OSS Console - update to 3.1.15
IBM Cloud Pak for Watson AIOps - update to 4.10.0
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
Telco Unified OSS Console - update to 3.1.15
External References
- https://github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed
- https://github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98
- https://github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07
- https://github.com/node-saml/xml-crypto/releases/tag/v2.1.6
- https://github.com/node-saml/xml-crypto/releases/tag/v3.2.1
- https://github.com/node-saml/xml-crypto/releases/tag/v6.0.1
- https://github.com/node-saml/xml-crypto/security/advisories/GHSA-x3m8-899r-f7c3
- https://workos.com/blog/samlstorm