Search for packages
| purl | pkg:deb/debian/simplesamlphp@1.9.2-1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-139j-7afy-wyf1
Aliases: CVE-2019-3465 GHSA-pqm6-cgwr-x6pf |
Improper Input Validation Rob Richards XmlSecLibs, as used for example by SimpleSAMLphp, performs incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message. |
Affected by 17 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-2cd3-p3xz-k3hx
Aliases: CVE-2020-5225 GHSA-6gc6-m364-85ww |
Inclusion of Sensitive Information in Log Files Log injection in `SimpleSAMLphp` before version. The `www/erroreport.php` script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, `SimpleSAMLphp` will output all its logs by appending each log line to a given file. Since the `reportID` parameter received in a request sent to `www/errorreport.php` was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content. |
Affected by 1 other vulnerability. |
|
VCID-4gux-4jrc-w7ce
Aliases: CVE-2018-6520 GHSA-2qfc-48v5-4w5h |
URL Redirection to Untrusted Site (Open Redirect) `SimpleSAMLphp` allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL. |
Affected by 4 other vulnerabilities. |
|
VCID-amz8-zhqx-p3c5
Aliases: CVE-2017-12874 GHSA-fj28-869x-vv5g |
Improper Input Validation The InfoCard module for `SimpleSAMLphp` allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities. |
Affected by 17 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-b3fn-bnh5-qyg4
Aliases: CVE-2016-9955 GHSA-p9cm-r7jg-8q3g |
Incorrect signature verification of SAML 1 messages An incorrect check of return values in the signature validation utilities allows an attacker to get invalid signatures accepted as valid by forcing an error during validation. get those messages accepted as valid and coming from a trusted entity. In practice, this means full capabilities to impersonate any individual at a given service provider. This vulnerability is not to be confused with the one described and related to SAML 2 messages. |
Affected by 17 other vulnerabilities. |
|
VCID-d1d1-jng1-4fe6
Aliases: CVE-2017-12873 GHSA-gp2m-7cfp-h6gf |
Session Fixation SimpleSAMLphp might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured. |
Affected by 17 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-dggq-bf45-aqga
Aliases: CVE-2020-5226 GHSA-mj9p-v2r8-wf8w |
Cross-site Scripting Cross-site scripting in `SimpleSAMLphp`. The `www/erroreport.php` script allows error reports to be submitted and sent to the system administrator. Starting with `SimpleSAMLphp`, a new `SimpleSAML\Utils\EMail` class was introduced to handle sending emails, implemented as a wrapper of an external dependency. This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in `www/errorreport.php` was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field. |
Affected by 1 other vulnerability. |
|
VCID-dgs2-3xbu-c3ff
Aliases: CVE-2017-12872 GHSA-v882-949x-6v28 |
Information Exposure The `SimpleSAML_Session` class in SimpleSAMLphp allows remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input. |
Affected by 4 other vulnerabilities. |
|
VCID-dvwj-zd42-nbhe
Aliases: CVE-2017-12870 GHSA-44pr-mgcp-v36r |
Information Exposure SimpleSAMLphp makes it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the `aesEncrypt` and `aesDecrypt` methods in the `SimpleSAML/Utils/Crypto` class to protect session identifiers in replies to non-HTTPS service providers. |
Affected by 4 other vulnerabilities. |
|
VCID-gwtm-bdae-3ufj
Aliases: CVE-2017-12867 GHSA-597c-mh7m-48v7 |
Invalid token creation and validation The `SimpleSAML_Auth_TimeLimitedToken` class in SimpleSAMLphp allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset. |
Affected by 17 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-jv7n-m3cf-jfex
Aliases: CVE-2016-3124 GHSA-9327-mqm6-x97j |
Information leakage in sanitycheck A remote attacker could learn information about the exact PHP version run by the affected system, allowing the search for vulnerabilities known to work with that version. |
Affected by 17 other vulnerabilities. |
|
VCID-k5d6-k216-8ub8
Aliases: CVE-2017-12871 GHSA-ww3w-592j-5qrw |
Incorrect IV generation for encryption The `aesEncrypt` method in `lib/SimpleSAML/Utils/Crypto` makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first bytes of the secret key as the initialization vector (IV). |
Affected by 4 other vulnerabilities. |
|
VCID-ma9b-k5br-ffhd
Aliases: CVE-2024-52596 GHSA-2x65-fpch-2fcm |
SimpleSAMLphp xml-common XXE vulnerability When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. |
Affected by 0 other vulnerabilities. |
|
VCID-mfwu-mfhq-fkh8
Aliases: CVE-2017-18122 GHSA-j4qf-3w33-8cgc |
Improper Verification of Cryptographic Signature A SimpleSAMLphp Service Provider using SAML will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid. Attributes contained in all the assertions received will be merged and the entityID of the first assertion received will be used, allowing an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP. |
Affected by 17 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-pskx-9d46-bfdt
Aliases: CVE-2017-18121 GHSA-fv7m-wc3v-wr3w |
Cross-site Scripting The consentAdmin module in SimpleSAMLphp is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser. |
Affected by 17 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-ucwf-xdma-h7fc
Aliases: CVE-2018-6519 GHSA-hhm8-2j4g-mpgg |
Injection Vulnerability The SAML2 library in `SimpleSAMLphp` has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp. |
Affected by 17 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-va8h-3qxg-uqh2
Aliases: CVE-2017-12868 GHSA-j96g-47x2-46hv |
Session fixation issue and authentication bypass The `secureCompare` method in `lib/SimpleSAML/Utils/Crypto` when used with PHP, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation. |
Affected by 4 other vulnerabilities. |
|
VCID-wbt9-snjj-uuea
Aliases: CVE-2018-7644 GHSA-923w-2xv2-7pr8 |
Improper signature validation The `XmlSecLibs` library as used in the saml2 library in SimpleSAMLphp incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue. |
Affected by 17 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-xx6m-pvgs-puga
Aliases: CVE-2018-7711 GHSA-g888-g2pp-82hf |
Incorrect signature validation An incorrect check of return values in the signature validation utilities allows an attacker to get invalid signatures accepted as valid by forcing an error during validation. |
Affected by 4 other vulnerabilities. |
|
VCID-yn8q-d76k-q3h2
Aliases: CVE-2017-12869 GHSA-qc43-78vj-vg7p |
Improper Input Validation The multiauth module in `SimpleSAMLphp` allows remote attackers to bypass authentication context restrictions and use an authentication source defined in `config/authsources.php` via vectors related to improper validation of user input. |
Affected by 17 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-ywuy-my3f-x7cd
Aliases: CVE-2018-6521 GHSA-qv5p-6wrc-79wg |
Security Misconfigurations The sqlauth module in `SimpleSAMLphp` relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions. |
Affected by 17 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-zemd-kbb3-s3cr
Aliases: CVE-2016-9814 GHSA-r8v4-7vwj-983x |
Incorrect signature verification An incorrect check of return values in the signature validation utilities allows an attacker to get invalid signatures accepted as valid by forcing an error during validation. |
Affected by 17 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-ew79-5kez-abdt | Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the link_href parameter. |
CVE-2012-0908
|
| VCID-jhx8-7x7y-z7cv | Improper Handling of Exceptional Conditions simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages. |
CVE-2011-4625
GHSA-5fj7-f8x3-q2mc |
| VCID-xhg6-p2ka-nfe9 | Cross-site scripting (XSS) vulnerability in modules/core/www/no_cookie.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the retryURL parameter. |
CVE-2012-0040
|