CVE-2017-12868
Critical
Description
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
SeverityCritical
CVSS9.8
Exploit probability82. percentile2.1%
Product
Simplesamlphp
PublishedSep 1, 2017
First seenSep 1, 2017
How to fix
Update
- simplesamlphp/simplesamlphp1.14.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simplesamlphp simplesamlphp | v ≤ 1.14.13 | — |
| simplesamlphp/simplesamlphpPackagist | 1.14.12 ≤ v < 1.14.14 | 1.14.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.