GitHub Advisoryadvisory · Packagist

GHSA-ggj9-6x8j-49w9 SimpleSAMLphp simplesamlphp-module-openid

MEDIUM Published 2023-01-01 Modified 2024-03-01 Official page ↗
Aliases
CVE-2010-10002
Ecosystem
Packagist
Packages
simplesamlphp/simplesamlphp-module-openid
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-01-10

Affected packages

• Packagist simplesamlphp/simplesamlphp-module-openid: < 1.0 → fixed in 1.0

Description

A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown function of the file `templates/consumer.php` of the component `OpenID Handler`. The manipulation of the argument `AuthState` leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0 can address this issue. The name of the patch is d652d41ccaf8c45d5707e741c0c5d82a2365a9a3. It is recommended to upgrade the affected component. VDB-217170 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Related

Alias · CVE (1)

  • CVE-2010-10002 ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References