GitHub Advisoryadvisory · Packagist

GHSA-j96g-47x2-46hv SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module

CRITICAL Published 2022-05-14 Modified 2024-04-25 Official page ↗
Aliases
CVE-2017-12868
Ecosystem
Packagist
Packages
simplesamlphp/simplesamlphp
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-384
Reviewed
2024-04-25

Affected packages

• Packagist simplesamlphp/simplesamlphp: >= 1.14.12, < 1.14.14 → fixed in 1.14.14

Description

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.

Related

Alias · CVE (1)

  • CVE-2017-12868 The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows… vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References