An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271). This issue affects Shibboleth Service Provider through 3.5.0.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8768-1 advisory.

    Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin.
    A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive     information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22854-1 advisory.

    This update for shibboleth-sp fixes the following issue

    - CVE-2025-9943: SQL injection in the ID attribute of the SAML response when the replay cache of the     Shibboleth       Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21418-1 advisory.

    This update for shibboleth-sp fixes the following issue

    - CVE-2025-9943: SQL injection in the ID attribute of the SAML response when the replay cache of the     Shibboleth       Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3123-1 advisory.

    This update for shibboleth-sp fixes the following issue:

    - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the     Shibboleth       Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3098-1 advisory.

    This update for shibboleth-sp fixes the following issue:

    - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the     Shibboleth       Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An SQL injection vulnerability has been identified in the ID attribute of the SAML response when the     replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage     service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the     extraction of arbitrary data from the database, if the database connection is configured to use the ODBC     plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file     odbc-store.cpp, lines 253-271). This issue affects Shibboleth Service Provider through 3.5.0.
    (CVE-2025-9943)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4300 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4300-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     September 14, 2025                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : shibboleth-sp     Version        : 3.2.2+dfsg1-1+deb11u1     CVE ID         : CVE-2025-9943     Debian Bug     : 1114506

    Florian Stuhlmann discovered a SQL vulnerability in the ODBC plugin in the     Shibboleth Service Provider which may result in information leak.

    For Debian 11 bullseye, this problem has been fixed in version     3.2.2+dfsg1-1+deb11u1.

    We recommend that you upgrade your shibboleth-sp packages.

    For the detailed security status of shibboleth-sp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/shibboleth-sp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
346240	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Shibboleth vulnerability (USN-8768-1)	Nessus	Ubuntu Local Security Checks	Local	critical
330331	SUSE SLES16 Security Update : shibboleth-sp (SUSE-SU-2026:22854-1)	Nessus	SuSE Local Security Checks	Local	critical
329520	openSUSE 16: libshibsp-lite12 / libshibsp12 / shibboleth-sp / etc (openSUSE-SU-2026:21418-1)	Nessus	SuSE Local Security Checks	Local	critical
328684	SUSE SLES15 Security Update : shibboleth-sp (SUSE-SU-2026:3123-1)	Nessus	SuSE Local Security Checks	Local	critical
327731	SUSE SLES12 Security Update : shibboleth-sp (SUSE-SU-2026:3098-1)	Nessus	SuSE Local Security Checks	Local	critical
264803	Linux Distros Unpatched Vulnerability : CVE-2025-9943	Nessus	Misc.	Local	critical
264781	Debian dla-4300 : libapache2-mod-shib - security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2025-9943

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical