cbcvebase.
CVE-2020-5226
published 2020-01-24

CVE-2020-5226: Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system…

PriorityP424medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.54%
42.0th percentile
Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp 1.18.0, a new SimpleSAML\Utils\EMail class was introduced to handle sending emails, implemented as a wrapper of an external dependency. This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in www/errorreport.php was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field.

Affected

6 ranges
VendorProductVersion rangeFixed in
debiansimplesamlphp< simplesamlphp 1.18.4-1 (bookworm)simplesamlphp 1.18.4-1 (bookworm)
simplesamlphpsimplesamlphp< 1.18.41.18.4
simplesamlphpsimplesamlphp——
simplesamlphpsimplesamlphp>= 0 < 1.18.4-11.18.4-1
simplesamlphpsimplesamlphp>= 0 < 1.18.4-11.18.4-1
simplesamlphpsimplesamlphp>= 1.18.0 < 1.18.41.18.4

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv5.4MEDIUM
vendor_redhat10.0CRITICAL
vendor_debian4.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.