CVE-2017-12870

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and…

published September 1, 2017

CVSS
—
EPSS
1%
Percentile
58.6
In the wild
Unconfirmed
What it is

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00875 · 58.6th percentile
Published
2017-09-01T13:00Z
EPSS history
Timeline
  • 01 SEP 13:00Z
    SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and…
    cvelistv5