« Volver al listado

CVE-2017-12871

Estado: ModificadaMedia (5.9)—

The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Simplesamlphp — Simplesamlphp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-12871",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-01T21:29:00.530",
  "references": [
    {
      "url": "https://github.com/simplesamlphp/simplesamlphp/commit/77df6a932d46daa35e364925eb73a175010dc904",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://simplesamlphp.org/security/201703-02",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/simplesamlphp/simplesamlphp/commit/77df6a932d46daa35e364925eb73a175010dc904",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://simplesamlphp.org/security/201703-02",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-326"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV)."
    },
    {
      "lang": "es",
      "value": "El método aesEncrypt en lib/SimpleSAML/Utils/Crypto.php en SimpleSAMLphp 1.14.x hasta la versión 1.14.11 facilita que los atacantes dependientes del contexto omitan el mecanismo de de protección de cifrado aprovechando el uso de los primeros 16 bytes de la clave secreta como vector de inicialización (IV)."
    }
  ],
  "lastModified": "2026-06-17T01:04:03.760",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18CCD17F-ABF0-468F-8675-9E5793FC3B9F"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "158D36D6-CE08-4DBB-A390-1D92242418CC"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF3A50E0-F98C-4414-910F-31CD8A73AE46"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC53A612-0089-4162-BC57-0FEC9BBE25C0"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64D1B626-9458-4FA0-B3F6-C9882072B548"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0138AEE-D6F3-4876-850A-F2F2727C54B7"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FAC8D43-079D-4143-B44D-D30B0F0B53C3"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4396B3D7-8A38-44F3-AC91-3F2665DBE50F"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "647A1484-6E5D-4E2D-8853-B42B1BF73E72"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47D19ADB-348C-48E0-8972-E0212664F84A"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D01B211-1424-418B-BE1E-661A60CF27B9"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.14.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35C9947E-FDC8-4C17-A4A0-10198555F9D5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}