CVE-2017-12870

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers.
References
Link Resource
https://simplesamlphp.org/security/201704-01 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-09-01 13:29

Updated : 2024-02-04 19:29


NVD link : CVE-2017-12870

Mitre link : CVE-2017-12870

CVE.ORG link : CVE-2017-12870


JSON object : View

Products Affected

simplesamlphp

  • simplesamlphp
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor