CVE-2017-12873 json
Incorrect persistent NameID generation in SimpleSAMLphp
published 2017-09-01 9 y ago modified 2026-06-17 4 mo ago also GHSA-gp2m-7cfp-h6gf , EUVD-2020-0265
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.
Patch / fix
- packagist simplesamlphp/simplesamlphp 1.14.11
- simplesamlphp Debian 14, Debian 12 1.14.11-1
debian advisories DEBIAN-CVE-2017-12873
Exploit prediction
1.66% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | simplesamlphp/simplesamlphp | >=1.7.0, <1.14.11 |
1.14.11 |
Classification
- Weakness
-
- CWE-384 Session Fixation
References
-
github.com
/simplesamlphp/simplesamlphp/commit/90dca835158495b173808273e7df127303b8b953
web, issue-tracking, patch, third-party-advisory
-
simplesamlphp.org
/security/201612-04
web, patch, vendor-advisory
-
debian.org
/security/2018/dsa-4127
vendor-advisory, web, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2017/12/msg00007.html
mailing-list, web, third-party-advisory
-
github.com
/simplesamlphp/simplesamlphp/security/advisories/GHSA-gp2m-7cfp-h6gf
web
-
nvd.nist.gov
/vuln/detail/CVE-2017-12873
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12873.yaml
web
Sources
- CVE List CVE-2017-12873
- GitHub Advisory GHSA-gp2m-7cfp-h6gf
- NVD CVE-2017-12873
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.