CVE-2017-12873

Опубликовано: 01 сент. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.

Ссылки

https://github.com/simplesamlphp/simplesamlphp/commit/90dca835158495b173808273e7df127303b8b953
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
Mailing List
Third Party Advisory
https://simplesamlphp.org/security/201612-04
Patch
Vendor Advisory
https://www.debian.org/security/2018/dsa-4127
Third Party Advisory
https://github.com/simplesamlphp/simplesamlphp/commit/90dca835158495b173808273e7df127303b8b953
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
Mailing List
Third Party Advisory
https://simplesamlphp.org/security/201612-04
Patch
Vendor Advisory
https://www.debian.org/security/2018/dsa-4127
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:*

Версия от 1.7.0 (включая) до 1.14.10 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00725

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-384

Связанные уязвимости

CVE-2017-12873

CVSS3: 9.8

ubuntu

больше 8 лет назад

CVE-2017-12873

CVSS3: 9.8

debian

больше 8 лет назад

SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain se ...

GHSA-gp2m-7cfp-h6gf

CVSS3: 9.8

github

около 6 лет назад

Incorrect persistent NameID generation in SimpleSAMLphp

EPSS

Процентиль: 72%

0.00725

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-384