5.9

CVE-2017-12871

The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Simplesamlphp ≫ Simplesamlphp Version1.14.0
Simplesamlphp ≫ Simplesamlphp Version1.14.1
Simplesamlphp ≫ Simplesamlphp Version1.14.2
Simplesamlphp ≫ Simplesamlphp Version1.14.3
Simplesamlphp ≫ Simplesamlphp Version1.14.4
Simplesamlphp ≫ Simplesamlphp Version1.14.5
Simplesamlphp ≫ Simplesamlphp Version1.14.6
Simplesamlphp ≫ Simplesamlphp Version1.14.7
Simplesamlphp ≫ Simplesamlphp Version1.14.8
Simplesamlphp ≫ Simplesamlphp Version1.14.9
Simplesamlphp ≫ Simplesamlphp Version1.14.10
Simplesamlphp ≫ Simplesamlphp Version1.14.11
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.379
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

https://github.com/simplesamlphp/simplesamlphp/commit/77df6a932d46daa35e364925eb73a175010dc904
Patch
Third Party Advisory
Issue Tracking
https://simplesamlphp.org/security/201703-02
Patch
Third Party Advisory
Issue Tracking