CVE-2016-9814

Published: Feb 17, 2017Modified: May 13, 2026

9.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean.

Affected (13)

Products: Simplesamlphp: Simplesamlphp, Saml2

Simplesamlphp

2 products

Simplesamlphp

Saml2

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Simplesamlphp Simplesamlphp	version ≤ 1.14.9
Simplesamlphp Simplesamlphp	Version 1.10

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Simplesamlphp Saml2	version ≤ 1.9
Simplesamlphp Saml2	Version 1.10.1
Simplesamlphp Saml2	Version 1.10.2
Simplesamlphp Saml2	Version 1.10
Simplesamlphp Saml2	Version 2.0.0
Simplesamlphp Saml2	Version 2.0.1
Simplesamlphp Saml2	Version 2.1
Simplesamlphp Saml2	Version 2.2
Simplesamlphp Saml2	Version 2.3.1
Simplesamlphp Saml2	Version 2.3.2
Simplesamlphp Saml2	Version 2.3