SimpleSAMLphp Invalid token creation and validation

MOYENNE 5.9CVE-2017-12867 · GHSA-597c-mh7m-48v7 · Published 29/08/2017 · updated 17/06/2026

En bref

CVE-2017-12867 est une vulnérabilité MOYENNE (CVSS 5.9) touchant simplesamlphp/simplesamlphp, simplesamlphp (simplesamlphp).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.3%, plus élevée que 69.4% des vulnérabilités.
Correctif : mettre à jour vers 1.14.15 ou plus récent.

Package	Affected versions	Patched versions
simplesamlphp/simplesamlphp Packagist	`≥ 1.14.0, < 1.14.15`	`1.14.15`
simplesamlphp simplesamlphp	`≤ 1.14.14`	No fix yet

Description

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.

NVD description

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.

References

nvd.nist.gov/vuln/detail/CVE-2017-12867 · ADVISORY
simplesamlphp/simplesamlphp commit 608f24c · WEB
FriendsOfPHP/security-advisories · WEB
simplesamlphp/simplesamlphp · PACKAGE
lists.debian.org/debian-lts-announce/2017/12/msg00007.html · WEB
simplesamlphp.org/security/201708-01 · WEB
debian.org/security/2018/dsa-4127 · WEB

Autres vulnérabilités de simplesamlphp/simplesamlphp

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

simplesamlphp/simplesamlphp

Packagist

≥ 1.14.0, < 1.14.15

1.14.15

simplesamlphp

≤ 1.14.14

No fix yet

Description

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.

NVD description

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.

Autres vulnérabilités de simplesamlphp/simplesamlphp

Tout voir →