PT-2017-12744 · Simplesamlphp · Infocard

Publicado 2017-09-01 · Atualizado 2022-05-14 · CVE-2017-12874

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions InfoCard module version 1.0 for SimpleSAMLphp

Description The issue allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

Recommendations For InfoCard module version 1.0, consider disabling the module until a patch is available to prevent XML message spoofing.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-12874

DLA-1205-1

DSA-4127-1

GHSA-FJ28-869X-VV5G

Produtos afetados

Infocard

Referências · 28

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp-module-infocard/CVE-2017-12874.yaml · Exploit
• https://github.com/simplesamlphp/simplesamlphp · Nota
• https://github.com/simplesamlphp/simplesamlphp-module-infocard/commit/63b84cc837ea62bf87f4bf4af29b4420f49311a9 · Nota
• https://osv.dev/vulnerability/CVE-2017-12874 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12867 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12874 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12874 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-4127-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7644 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6521 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-12874 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-12874 · Nota de Segurança
• https://packages.debian.org/src:simplesamlphp · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12874 · Nota de Segurança