Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xYzQzLTc4dmotdmc3cM4AATfU

SimpleSAMLphp Authentication context bypass in the multiauth module

The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.

Permalink: https://github.com/advisories/GHSA-qc43-78vj-vg7p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xYzQzLTc4dmotdmc3cM4AATfU
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 10 days ago

CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-qc43-78vj-vg7p, CVE-2017-12869
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-12869
• https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
• https://simplesamlphp.org/security/201704-02
• https://www.debian.org/security/2018/dsa-4127
• https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12869.yaml
• https://github.com/simplesamlphp/simplesamlphp/blob/de98fc5bb663feea16686ae77958f759b4a7638d/docs/simplesamlphp-changelog-1.x.md?plain=1#L902C64-L902C79
• https://github.com/advisories/GHSA-qc43-78vj-vg7p

Repository: https://github.com/simplesamlphp/simplesamlphp
Blast Radius: 18.8

Affected Packages