SimpleSAMLphp Invalid token creation and validation

MEDIO 5.9CVE-2017-12867 · GHSA-597c-mh7m-48v7 · Published 29/08/2017 · updated 17/06/2026

In breve

CVE-2017-12867 è una vulnerabilità MEDIO (CVSS 5.9) che riguarda simplesamlphp/simplesamlphp, simplesamlphp (simplesamlphp).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 69.4% delle vulnerabilità.
Correzione: aggiornare a 1.14.15 o successiva.

Package	Affected versions	Patched versions
simplesamlphp/simplesamlphp Packagist	`≥ 1.14.0, < 1.14.15`	`1.14.15`
simplesamlphp simplesamlphp	`≤ 1.14.14`	No fix yet

Description

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.

NVD description

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.

References

nvd.nist.gov/vuln/detail/CVE-2017-12867 · ADVISORY
simplesamlphp/simplesamlphp commit 608f24c · WEB
FriendsOfPHP/security-advisories · WEB
simplesamlphp/simplesamlphp · PACKAGE
lists.debian.org/debian-lts-announce/2017/12/msg00007.html · WEB
simplesamlphp.org/security/201708-01 · WEB
debian.org/security/2018/dsa-4127 · WEB

Altre vulnerabilità di simplesamlphp/simplesamlphp

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

simplesamlphp/simplesamlphp

Packagist

≥ 1.14.0, < 1.14.15

1.14.15

simplesamlphp

≤ 1.14.14

No fix yet

Description

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.

NVD description

The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.

Altre vulnerabilità di simplesamlphp/simplesamlphp

Vedi tutto →