PT-2017-12744 · Simplesamlphp · Infocard

Published 2017-09-01 · Updated 2022-05-14 · CVE-2017-12874

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions InfoCard module version 1.0 for SimpleSAMLphp

Description The issue allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

Recommendations For InfoCard module version 1.0, consider disabling the module until a patch is available to prevent XML message spoofing.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-12874

DLA-1205-1

DSA-4127-1

GHSA-FJ28-869X-VV5G

Affected Products

Infocard

References · 28

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp-module-infocard/CVE-2017-12874.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2017-12874 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12867 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12874 · Security Note
• https://osv.dev/vulnerability/DSA-4127-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7644 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6521 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-12874 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-12874 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12874 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12873 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12869 · Security Note
• https://simplesamlphp.org/security/201612-03 · Vendor Advisory