En bref
- CVE-2017-12872 est une vulnérabilité MOYENNE (CVSS 5.9) touchant simplesamlphp/simplesamlphp, simplesamlphp (simplesamlphp).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.5%, plus élevée que 73.6% des vulnérabilités.
- Correctif : mettre à jour vers 1.15.0-rc1 ou plus récent.
Description
The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input.
NVD description
The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input.
Autres vulnérabilités de simplesamlphp/simplesamlphp
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free