CVE-2016-9955

MEDIUM

Simplesamlphp < 1.14.11 - Improper Input Validation

Title source: rule

Description

The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.

References (3)

Scores

CVSS v3 6.3
EPSS 0.0041
EPSS Percentile 61.0%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Classification

CWE
CWE-20
Status published

Affected Products (4)

simplesamlphp/simplesamlphp < 1.14.11
debian/debian_linux
simplesamlphp/simplesamlphp < 1.14.11Packagist
n/a/n/a

Timeline

Published Feb 17, 2017
Tracked Since Feb 18, 2026