Search for packages
| purl | pkg:deb/debian/simplesamlphp@1.16.3-1%2Bdeb10u2 |
| Next non-vulnerable version | 1.19.7-1+deb12u2 |
| Latest non-vulnerable version | 1.19.7-1+deb12u2 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-139j-7afy-wyf1
Aliases: CVE-2019-3465 GHSA-pqm6-cgwr-x6pf |
Improper Input Validation Rob Richards XmlSecLibs, as used for example by SimpleSAMLphp, performs incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message. |
Affected by 3 other vulnerabilities. |
|
VCID-2cd3-p3xz-k3hx
Aliases: CVE-2020-5225 GHSA-6gc6-m364-85ww |
Inclusion of Sensitive Information in Log Files Log injection in `SimpleSAMLphp` before version. The `www/erroreport.php` script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, `SimpleSAMLphp` will output all its logs by appending each log line to a given file. Since the `reportID` parameter received in a request sent to `www/errorreport.php` was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content. |
Affected by 3 other vulnerabilities. |
|
VCID-6c55-4pyx-ckbx
Aliases: CVE-2025-27773 GHSA-46r4-f8gj-xg56 |
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding There's a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. I believe that it exists for v4 only. I have not yet developed a PoC. V5 is well designed and instead builds the signed query from the same message that will be consumed. |
Affected by 0 other vulnerabilities. |
|
VCID-8b8r-g7e2-qfb2
Aliases: CVE-2024-52806 GHSA-pxm4-r5ph-q2m2 |
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages Summary When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. |
Affected by 0 other vulnerabilities. |
|
VCID-dggq-bf45-aqga
Aliases: CVE-2020-5226 GHSA-mj9p-v2r8-wf8w |
Cross-site Scripting Cross-site scripting in `SimpleSAMLphp`. The `www/erroreport.php` script allows error reports to be submitted and sent to the system administrator. Starting with `SimpleSAMLphp`, a new `SimpleSAML\Utils\EMail` class was introduced to handle sending emails, implemented as a wrapper of an external dependency. This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in `www/errorreport.php` was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field. |
Affected by 3 other vulnerabilities. |
|
VCID-ma9b-k5br-ffhd
Aliases: CVE-2024-52596 GHSA-2x65-fpch-2fcm |
SimpleSAMLphp xml-common XXE vulnerability When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-139j-7afy-wyf1 | Improper Input Validation Rob Richards XmlSecLibs, as used for example by SimpleSAMLphp, performs incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message. |
CVE-2019-3465
GHSA-pqm6-cgwr-x6pf |
| VCID-4gux-4jrc-w7ce | URL Redirection to Untrusted Site (Open Redirect) `SimpleSAMLphp` allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL. |
CVE-2018-6520
GHSA-2qfc-48v5-4w5h |
| VCID-dgs2-3xbu-c3ff | Information Exposure The `SimpleSAML_Session` class in SimpleSAMLphp allows remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input. |
CVE-2017-12872
GHSA-v882-949x-6v28 |
| VCID-dvwj-zd42-nbhe | Information Exposure SimpleSAMLphp makes it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the `aesEncrypt` and `aesDecrypt` methods in the `SimpleSAML/Utils/Crypto` class to protect session identifiers in replies to non-HTTPS service providers. |
CVE-2017-12870
GHSA-44pr-mgcp-v36r |
| VCID-gwtm-bdae-3ufj | Invalid token creation and validation The `SimpleSAML_Auth_TimeLimitedToken` class in SimpleSAMLphp allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset. |
CVE-2017-12867
GHSA-597c-mh7m-48v7 |
| VCID-k5d6-k216-8ub8 | Incorrect IV generation for encryption The `aesEncrypt` method in `lib/SimpleSAML/Utils/Crypto` makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first bytes of the secret key as the initialization vector (IV). |
CVE-2017-12871
GHSA-ww3w-592j-5qrw |
| VCID-mfwu-mfhq-fkh8 | Improper Verification of Cryptographic Signature A SimpleSAMLphp Service Provider using SAML will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid. Attributes contained in all the assertions received will be merged and the entityID of the first assertion received will be used, allowing an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP. |
CVE-2017-18122
GHSA-j4qf-3w33-8cgc |
| VCID-pskx-9d46-bfdt | Cross-site Scripting The consentAdmin module in SimpleSAMLphp is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser. |
CVE-2017-18121
GHSA-fv7m-wc3v-wr3w |
| VCID-ucwf-xdma-h7fc | Injection Vulnerability The SAML2 library in `SimpleSAMLphp` has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp. |
CVE-2018-6519
GHSA-hhm8-2j4g-mpgg |
| VCID-va8h-3qxg-uqh2 | Session fixation issue and authentication bypass The `secureCompare` method in `lib/SimpleSAML/Utils/Crypto` when used with PHP, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation. |
CVE-2017-12868
GHSA-j96g-47x2-46hv |
| VCID-wbt9-snjj-uuea | Improper signature validation The `XmlSecLibs` library as used in the saml2 library in SimpleSAMLphp incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue. |
CVE-2018-7644
GHSA-923w-2xv2-7pr8 |
| VCID-xx6m-pvgs-puga | Incorrect signature validation An incorrect check of return values in the signature validation utilities allows an attacker to get invalid signatures accepted as valid by forcing an error during validation. |
CVE-2018-7711
GHSA-g888-g2pp-82hf |
| VCID-yn8q-d76k-q3h2 | Improper Input Validation The multiauth module in `SimpleSAMLphp` allows remote attackers to bypass authentication context restrictions and use an authentication source defined in `config/authsources.php` via vectors related to improper validation of user input. |
CVE-2017-12869
GHSA-qc43-78vj-vg7p |
| VCID-ywuy-my3f-x7cd | Security Misconfigurations The sqlauth module in `SimpleSAMLphp` relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions. |
CVE-2018-6521
GHSA-qv5p-6wrc-79wg |