« Volver al listado

CVE-2016-9814

Estado: ModificadaCrítica (9.1)—

The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Simplesamlphp — Saml2Simplesamlphp — Simplesamlphp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-9814",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:C",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 7.8,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-02-17T02:59:14.047",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94730",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00001.html",
      "source": "security@debian.org"
    },
    {
      "url": "https://simplesamlphp.org/security/201612-01",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/94730",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://simplesamlphp.org/security/201612-01",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The validateSignature method in the SAML2\\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean."
    },
    {
      "lang": "es",
      "value": "El método validateSignature en la clase SAML2\\Utils en SimpleSAMLphp en versiones anteriores a 1.14.10 y la librería simplesamlphp/saml2 en versiones anteriores a 1.9.1, 1.10.x en versiones anteriores a 1.10.3 y 2.x en versiones anteriores a 2.3.3 permite a atacantes remotos suplantar respuestas SAML o posiblemente provocar una denegación de servicio (consumo de memoria) aprovechando la conversión incorrecta de valores de retorno a valores booleanos."
    }
  ],
  "lastModified": "2026-06-17T00:56:35.603",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3256DE37-C892-4D74-8C48-4D35B0F24F3E",
              "versionEndIncluding": "1.14.9"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:simplesamlphp:1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09E5E12B-6080-48D0-8750-B5CC9985754B"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5595B4ED-0C6B-4D18-9013-AF09A9159FBB",
              "versionEndIncluding": "1.9"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "274F4568-8E1F-4AB4-B701-157D9ACC0D03"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:1.10.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FF505BF-B66C-42FB-9BDE-609B9A563A9E"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:1.10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E294F52A-270E-4F48-B0C6-6ADDC84E2E19"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:2.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F81F843-780A-46D1-B1D9-8F0BD4A5CD9A"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:2.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA43E174-713E-442D-8931-AC25517DF58D"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B11FE355-5ECC-4DC3-8826-B366798FCE80"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69A4843F-0D4C-4B98-8FB9-48B6D9D7499A"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBEB6E3F-9408-4D91-90A0-E7F48AF60EA0"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:2.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DE2F0BD-EC4C-4EF1-AD1B-F4CE87D0D04D"
            },
            {
              "criteria": "cpe:2.3:a:simplesamlphp:saml2:2.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8669F36F-D030-49CA-B679-FE349EE4E450"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}