CVE-2023-22947: 
Shibboleth Service Provider vulnerability analysis and mitigation

Shibboleth Service Provider (SP) versions before 3.4.1 contained a security vulnerability related to insecure folder permissions in the Windows installation path. The vulnerability was discovered and assigned CVE-2023-22947, allowing unprivileged local users potential access to sensitive files (NVD).

The vulnerability stems from improper file system Access Control Lists (ACLs) configuration during the installation process. Prior to version 3.4.1, the installer did not properly adjust file system ACLs based on the installation path, potentially leaving sensitive files accessible to unauthorized users (Shibboleth Wiki).

The vulnerability could allow unprivileged local users to access sensitive files and folders within the Shibboleth SP installation directory, potentially compromising the security of the authentication system (NVD).

The vulnerability requires local system access to exploit. An attacker would need to have access to the Windows system where Shibboleth SP is installed to take advantage of the improper file permissions (NVD).

The vulnerability was addressed in Shibboleth SP version 3.4.1, which implements proper ACL restrictions. The updated version provides full access to administrative/system accounts and read access to the standard 'Users' group by default. Organizations are advised to upgrade to version 3.4.1 or later and review their file system permissions. Additionally, administrators can specify custom access permissions during installation using the WEBSERVER_USER property (Shibboleth Wiki).