CVE-2020-5225
published 2020-01-24CVE-2020-5225: Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.65%
47.0th percentile
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the reportID parameter received in a request sent to www/errorreport.php was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | simplesamlphp | < simplesamlphp 1.18.4-1 (bookworm) | simplesamlphp 1.18.4-1 (bookworm) |
| simplesamlphp | simplesamlphp | < 1.18.4 | 1.18.4 |
| simplesamlphp | simplesamlphp | >= 0 < 1.18.4-1 | 1.18.4-1 |
| simplesamlphp | simplesamlphp | >= 0 < 1.18.4-1 | 1.18.4-1 |
| simplesamlphp | simplesamlphp | >= 0 < 1.18.4 | 1.18.4 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
osv5.4MEDIUM
vendor_debian4.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Log injection in SimpleSAMLphp
osv·2020-01-24
CVE-2020-5225 [LOW] Log injection in SimpleSAMLphp
Log injection in SimpleSAMLphp
### Background
SimpleSAMLphp has a logging functionality that allows system administrators to keep track of the activity, errors, and statistics. Additionally, it allows users to report errors, shall they happen. An error report contains a report identifier, which is logged once submitted.
### Description
The `www/erroreport.php` script, which receives error reports and sends them via email to the system administrator, didn't properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID.
When configured to use the `file` logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the `report
GHSA
Log injection in SimpleSAMLphp
ghsa·2020-01-24
CVE-2020-5225 [LOW] CWE-532 Log injection in SimpleSAMLphp
Log injection in SimpleSAMLphp
### Background
SimpleSAMLphp has a logging functionality that allows system administrators to keep track of the activity, errors, and statistics. Additionally, it allows users to report errors, shall they happen. An error report contains a report identifier, which is logged once submitted.
### Description
The `www/erroreport.php` script, which receives error reports and sends them via email to the system administrator, didn't properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID.
When configured to use the `file` logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the `report
OSV
CVE-2020-5225: Log injection in SimpleSAMLphp before version 1
osv·2020-01-24·CVSS 5.4
CVE-2020-5225 [MEDIUM] CVE-2020-5225: Log injection in SimpleSAMLphp before version 1
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the reportID parameter received in a request sent to www/errorreport.php was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.
Debian
CVE-2020-5225: simplesamlphp - Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php scr...
vendor_debian·2020·CVSS 4.4
CVE-2020-5225 [MEDIUM] CVE-2020-5225: simplesamlphp - Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php scr...
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the reportID parameter received in a request sent to www/errorreport.php was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.
Scope: local
bookworm: resolved (fixed in 1.18.4-1)
bullseye:
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-01-24
Published