CVE-2018-7644
NONE EPSS 66.0%
Published Mar 5, 20188y ago · Modified Jun 17, 20262w ago
Published Mar 5, 2018 8y ago
Last Modified Jun 17, 2026 2w ago
Description
The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.
Threat Intelligence
EPSS Exploit Probability
66.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-347
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| simplesamlphp | simplesamlphp | * | <1.15.3 |
References 1
- simplesamlphp.org https://simplesamlphp.org/security/201802-01
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.