Sensitive information in log files in SimpleSAMLphp
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the reportID parameter received in a request sent to www/errorreport.php was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| simplesamlphp | SimpleSAMLphp | before 1.18.4 | 1.18.4 | Patch available | CNA |
| — | simplesamlphp/simplesamlphp (Packagist) | before 1.18.4 | 1.18.4 | Patch available | GHSA-6gc6-m364-85ww |
- SimpleSAMLphp Vendorsimplesamlphp Affected before 1.18.4 Fixed in 1.18.4 Patch available CNA
- simplesamlphp/simplesamlphp (Packagist) Vendor— Affected before 1.18.4 Fixed in 1.18.4 Patch available GHSA-6gc6-m364-85ww
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:* | before 1.18.4 | Vulnerable | simplesamlphp |
- cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:* Versions before 1.18.4 Vulnerable ·simplesamlphp
Remediation
- Fix · CNA SimpleSAMLphp (simplesamlphp) Fixed in 1.18.4
- Fix · GHSA-6gc6-m364-85ww simplesamlphp/simplesamlphp (Packagist) Fixed in 1.18.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5225
- 2026-10-03 Alias added: GHSA-6gc6-m364-85ww
- 2026-10-09 EPSS moved to the 50th–90th percentile
References
More Simplesamlphp vulnerabilities
- TI-2018-04801 The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which… CVSS 3.0CRITICAL 9.8
- TI-2017-09530 The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and… CVSS 3.0CRITICAL 9.8
- TI-2017-09535 SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive… CVSS 3.0CRITICAL 9.8
- TI-2016-07944 The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and… CVSS 3.0CRITICAL 9.1
- TI-2019-02593 Improper signature verification in Rob Richards XmlSecLibs CVSS 3.1HIGH 8.8
- TI-2018-05557 HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect… CVSS 3.0HIGH 8.1
Sources
- CVE-2020-5225 · CVE Program
- CVE-2020-5225 · NVD
- FIRST EPSS
- GHSA-6gc6-m364-85ww · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences