Описание
HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.
Ссылки
- Patch
- Third Party Advisory
- Vendor Advisory
- Patch
- Third Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
8.1 High
CVSS3
6.8 Medium
CVSS2
Дефекты
Связанные уязвимости
HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.
HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 h ...
SimpleSAMLphp saml2 incorrect signature validation
EPSS
8.1 High
CVSS3
6.8 Medium
CVSS2