high7.5
CVE-2017-12869
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication sourc…
Impact
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Simplesamlphp | Simplesamlphp | through 1.14.13 |
| Debian | Debian Linux | Versions 7.0, 8.0, 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
- https://simplesamlphp.org/security/201704-02
- https://www.debian.org/security/2018/dsa-4127
- https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
- https://simplesamlphp.org/security/201704-02
- https://www.debian.org/security/2018/dsa-4127