Is CVE-2023-45683 actively exploited?

No active exploitation of CVE-2023-45683 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-45683 be exploited remotely?

Yes. CVE-2023-45683 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-45683?

CVE-2023-45683 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2023-45683

MEDIUM

CVE-2023-45683

CWE-79Published: October 16, 2023· Updated: Jun 17, 2026

6.1

CVSS v3.1

Official Description

github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata.

NVD Source

Technical Analysis

CVE-2023-45683 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.