CVE-2017-12873
CriticalSummary
SimpleSAMLphp versions 1.7.0 through 1.14.10 may allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.
Risk Assessment
The organization may be exposed to data leaks and unauthorized access to systems, which can lead to serious legal and reputational consequences.
Recommendation
It is recommended to update SimpleSAMLphp to the latest version and thoroughly check the Identity Provider configuration to prevent potential attacks.
Original NVD description (English source)
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.