CVEvulnerability
CVE-2017-12873
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-09-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-384
Description
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.
Affected configurations
• simplesamlphp simplesamlphp (>= 1.7.0 <= 1.14.10)
• debian debian linux 7.0
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-384 Session Fixation weakness
References
- https://github.com/simplesamlphp/simplesamlphp/commit/90dca835158495b173808273e7df127303b8b953 Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html Mailing List, Third Party Advisory
- https://simplesamlphp.org/security/201612-04 Patch, Vendor Advisory
- https://www.debian.org/security/2018/dsa-4127 Third Party Advisory
- https://github.com/simplesamlphp/simplesamlphp/commit/90dca835158495b173808273e7df127303b8b953 Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html Mailing List, Third Party Advisory
- https://simplesamlphp.org/security/201612-04 Patch, Vendor Advisory
- https://www.debian.org/security/2018/dsa-4127 Third Party Advisory