CVE-2017-12867: Medium severity simplesamlphp vulnerability
Invalid token creation and validation
Other sources
The SimpleSAMLAuthTimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12867?
CVE-2017-12867 is considered a critical vulnerability due to the potential for unauthorized access through token manipulation.
How do I fix CVE-2017-12867?
To fix CVE-2017-12867, upgrade SimpleSAMLphp to version 1.14.15 or later.
What versions of SimpleSAMLphp are affected by CVE-2017-12867?
CVE-2017-12867 affects SimpleSAMLphp versions prior to 1.14.15.
Can accessing a secret token exploit CVE-2017-12867?
Yes, attackers can exploit CVE-2017-12867 by accessing a secret token and manipulating the time offset for extended validity.
What is the function of the SimpleSAML_Auth_TimeLimitedToken class related to CVE-2017-12867?
The SimpleSAML_Auth_TimeLimitedToken class is responsible for creating and validating tokens, which can be manipulated due to this vulnerability.