CVE Feed

    Dashboard / CVE / CVE-2017-12871

    CVE-2017-12871

    The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).

    Published:Sep 1, 2017
    Last Modified:Apr 20, 2025
    EPS:Sep 1, 2017
    EPSS Score:0.0008
    CVSS Score:5.9

    Affected Products

    Vendor
    Simplesamlphp
    Product
    Simplesamlphp

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-326 Inadequate Encryption Strength

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-112 Brute Force
    CAPEC-192 Protocol Analysis
    CAPEC-20 Encryption Brute Forcing

    Related CVEs

    CVE-2026-49284 (CVSS 7.1) — SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2…
    CVE-2020-5301 (CVSS 3) — SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in…
    CVE-2020-5226 (CVSS 4.4) — Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error report…
    CVE-2020-5225 (CVSS 4.4) — Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error repo…
    CVE-2019-3465 (CVSS 8.8) — Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorre…
    CVE-2011-4625 (CVSS 7.5) — simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could all…
    CVE-2018-7711 (CVSS 8.1) — HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values i…
    CVE-2018-7644 (CVSS 7.5) — The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signat…
    CVE-2017-18122 (CVSS 8.1) — A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service P…
    CVE-2017-18121 (CVSS 6.1) — The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allow…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High