{"id":"GHSA-fj28-869x-vv5g","aliases":["CVE-2017-12874"],"title":"SimpleSAMLphp InfoCard module Incorrect signature verification","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.","severity":"high","score":7.5,"published":"2022-05-14T01:05:32.000Z","modified":"2024-04-25T21:26:44.871Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"simplesamlphp/simplesamlphp-module-infocard","sources":[{"name":"OSV · GHSA-fj28-869x-vv5g","url":"https://osv.dev/vulnerability/GHSA-fj28-869x-vv5g"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.1"}],"type":"ECOSYSTEM"}],"versions":["v1.0"],"fixed":["1.0.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-12874","https://github.com/simplesamlphp/simplesamlphp-module-infocard/commit/63b84cc837ea62bf87f4bf4af29b4420f49311a9","https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp-module-infocard/CVE-2017-12874.yaml","https://github.com/simplesamlphp/simplesamlphp","https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html","https://simplesamlphp.org/security/201612-03","https://www.debian.org/security/2018/dsa-4127"],"sources":[{"name":"OSV","id":"GHSA-fj28-869x-vv5g","modified":"2024-04-25T21:26:44.871062Z","url":"https://osv.dev/vulnerability/GHSA-fj28-869x-vv5g"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T01:50:33.295Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}