CVE-2012-0908: XSS
Published Jan 24, 2012
·Updated
Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the linkhref parameter.
Affected Software
16 affected components
SimpleSAMLphp<=1.8.1
SimpleSAMLphp=0.4
SimpleSAMLphp=0.5
SimpleSAMLphp=1.0
SimpleSAMLphp=1.1
SimpleSAMLphp=1.2
SimpleSAMLphp=1.3
SimpleSAMLphp=1.4
SimpleSAMLphp=1.5
SimpleSAMLphp=1.5.1
SimpleSAMLphp=1.6
SimpleSAMLphp=1.6.1
SimpleSAMLphp=1.6.2
SimpleSAMLphp=1.6.3
SimpleSAMLphp=1.7
SimpleSAMLphp=1.8
Event History
Jan 24, 2012
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-0908?
CVE-2012-0908 has been classified as a high severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2012-0908?
To mitigate CVE-2012-0908, upgrade SimpleSAMLphp to version 1.8.2 or later.
3
What systems are affected by CVE-2012-0908?
CVE-2012-0908 affects SimpleSAMLphp versions up to 1.8.1 and earlier versions including 0.4 to 1.7.
4
What type of vulnerability is CVE-2012-0908?
CVE-2012-0908 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web script or HTML.
5
Can CVE-2012-0908 be exploited remotely?
Yes, CVE-2012-0908 can be exploited remotely by attackers via the link_href parameter in logout.php.