Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2017-18121: SimpleSAMLphp: Malicious Links Can Run Code on Your Browser
CVE-2017-18121 · published 8 years ago
Summary
The consentAdmin module in SimpleSAMLphp is vulnerable to a security issue that allows hackers to create links that can run malicious code on your website visitors' browsers. This could lead to unauthorized access or data theft. To fix this, update SimpleSAMLphp to version 1.14.16 or later.
What to do
- Update simplesamlphp simplesamlphp to version 1.14.16.
- Update debian simplesamlphp to version 1.15.0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | simplesamlphp | simplesamlphp |
>= 1.12.0, < 1.14.16 Fix: upgrade to 1.14.16
|
| – | simplesamlphp | simplesamlphp |
<= 1.14.15 cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
7.0 8.0 9.0 cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| Debian:11 | debian | simplesamlphp |
< 1.15.0-1 Fix: upgrade to 1.15.0-1
|
| Debian:12 | debian | simplesamlphp |
< 1.15.0-1 Fix: upgrade to 1.15.0-1
|
| Debian:14 | debian | simplesamlphp |
< 1.15.0-1 Fix: upgrade to 1.15.0-1
|
Original advisory text
The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the vict...
The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser.
References
- https://simplesamlphp.org/security/201709-01
- https://www.debian.org/security/2018/dsa-4127
- https://nvd.nist.gov/vuln/detail/CVE-2017-18121
- https://lists.debian.org/debian-lts-announce/2018/02/msg00008.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/si...
- https://github.com/advisories/GHSA-fv7m-wc3v-wr3w
- https://security-tracker.debian.org/tracker/CVE-2017-18121 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Feb 2018
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta