Read the docs
TI-2020-04282 Aliases CVE-2020-5226GHSA-mj9p-v2r8-wf8w

Cross-site scripting in SimpleSAMLphp

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp 1.18.0, a new SimpleSAML\Utils\EMail class was introduced to handle sending emails, implemented as a wrapper of an external dependency. This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in www/errorreport.php was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field.

Why it matters now

EPSS 0.00544 45th percentileScored 2026-11-07
Fix Fixed SimpleSAMLphp (simplesamlphp): 1.18.4simplesamlphp/simplesamlphp (Packagist): 1.18.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
simplesamlphpSimpleSAMLphp1.18.0 to before 1.18.41.18.4Patch availableCNA
—simplesamlphp/simplesamlphp (Packagist)1.18.0 to before 1.18.41.18.4Patch availableGHSA-mj9p-v2r8-wf8w
  • SimpleSAMLphp Vendorsimplesamlphp Affected 1.18.0 to before 1.18.4 Fixed in 1.18.4 Patch available CNA
  • simplesamlphp/simplesamlphp (Packagist) Vendor— Affected 1.18.0 to before 1.18.4 Fixed in 1.18.4 Patch available GHSA-mj9p-v2r8-wf8w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:*before 1.18.4Vulnerablesimplesamlphp
  • cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:* Versions before 1.18.4 Vulnerable ·simplesamlphp

Remediation

  • Fix · CNA SimpleSAMLphp (simplesamlphp) Fixed in 1.18.4
  • Fix · GHSA-mj9p-v2r8-wf8w simplesamlphp/simplesamlphp (Packagist) Fixed in 1.18.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5226
  2. 2026-10-03 Alias added: GHSA-mj9p-v2r8-wf8w

References

Advisory 3

  • TI-2018-04801 The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which… CVSS 3.0CRITICAL 9.8
  • TI-2017-09530 The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and… CVSS 3.0CRITICAL 9.8
  • TI-2017-09535 SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive… CVSS 3.0CRITICAL 9.8
  • TI-2016-07944 The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and… CVSS 3.0CRITICAL 9.1
  • TI-2019-02593 Improper signature verification in Rob Richards XmlSecLibs CVSS 3.1HIGH 8.8
  • TI-2018-05557 HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect… CVSS 3.0HIGH 8.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences