{"id":"CVE-2017-12868","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-12868","generatedAt":"2026-10-29T02:45:46.670Z","title":"The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character…","description":"The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.","published":"2017-09-01T13:29:00.000Z","lastModified":"2026-06-17T01:04:03.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-384"],"affected":["simplesamlphp/simplesamlphp"],"epss":{"score":0.02133,"percentile":0.81898,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (2.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/simplesamlphp/simplesamlphp/commit/4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85e","tags":["Issue Tracking","Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00017.html","source":"cve@mitre.org"},{"url":"https://simplesamlphp.org/security/201705-01","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/simplesamlphp/simplesamlphp/commit/4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85e","tags":["Issue Tracking","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00017.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://simplesamlphp.org/security/201705-01","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-12868","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}