PT-2017-12736
CVE-2017-12867
·
تاريخ النشر
2017-08-29
·
تاريخ التحديث
2022-05-13
الوصف من
CVSS 3.1
5.9
متوسطةالمقاييسAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
SimpleSAMLphp versions 1.14.14 and earlier
Description
The issue allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset in the SimpleSAML Auth TimeLimitedToken class.
Recommendations
For versions 1.14.14 and earlier, consider restricting access to the SimpleSAML Auth TimeLimitedToken class until a patch is available.
As a temporary workaround, limit the ability to manipulate the time offset to prevent attackers from extending the token's validity period.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾