Vulnerability Details CVE-2012-0908
Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the link_href parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 63.8%
CVSS Severity
CVSS v2 Score 4.3
References
- http://code.google.com/p/simplesamlphp/issues/detail?id=468
- http://osvdb.org/78255
- http://secunia.com/advisories/47491
- http://www.openwall.com/lists/oss-security/2012/01/20/20
- http://www.securityfocus.com/bid/51372
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72313
- http://code.google.com/p/simplesamlphp/issues/detail?id=468
- http://osvdb.org/78255
- http://secunia.com/advisories/47491
- http://www.openwall.com/lists/oss-security/2012/01/20/20
- http://www.securityfocus.com/bid/51372
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72313
Products affected by CVE-2012-0908
-
cpe:2.3:a:simplesamlphp:simplesamlphp:0.4
-
cpe:2.3:a:simplesamlphp:simplesamlphp:0.5
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.0
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.1
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.2
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.3
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.4
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.5
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.5.0
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.5.1
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.6
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.6.0
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.6.1
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.6.2
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.6.3
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.7
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.7.0
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.8
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.8.0
-
cpe:2.3:a:simplesamlphp:simplesamlphp:1.8.1