TI-2020-04357 Aliases CVE-2020-5301 GHSA-24m3-w8g9-jwpq

Information disclosure of source code in SimpleSAMLphp

LOW 17CWE-200Published 2020-04-21 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that processes requests for pages hosted by modules, has code to identify paths ending with `.php` and process those as PHP code. If no other suitable way of handling the given path exists it presents the file to the browser. The check to identify paths ending with `.php` does not account for uppercase letters. If someone requests a path ending with e.g. `.PHP` and the server is serving the code from a case-insensitive file system, such as on Windows, the processing of the PHP code does not occur, and the source code is instead presented to the browser. An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. This issue is fixed in version 1.18.6.

Why it matters now

EPSS 0.00922 60th percentileScored 2026-11-07

Fix Fixed simplesamlphp (simplesamlphp): 1.18.6simplesamlphp/simplesamlphp (Packagist): 1.18.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
simplesamlphp	simplesamlphp	before 1.18.6	1.18.6	Patch available	CNA
—	simplesamlphp/simplesamlphp (Packagist)	before 1.18.6	1.18.6	Patch available	GHSA-24m3-w8g9-jwpq

simplesamlphp Vendorsimplesamlphp Affected before 1.18.6 Fixed in 1.18.6 Patch available CNA
simplesamlphp/simplesamlphp (Packagist) Vendor— Affected before 1.18.6 Fixed in 1.18.6 Patch available GHSA-24m3-w8g9-jwpq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:simplesamlphp:simplesamlphp::::::::	before 1.18.6	Vulnerable	simplesamlphp

cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:* Versions before 1.18.6 Vulnerable ·simplesamlphp

Remediation

Fix · CNA simplesamlphp (simplesamlphp) Fixed in 1.18.6
Fix · GHSA-24m3-w8g9-jwpq simplesamlphp/simplesamlphp (Packagist) Fixed in 1.18.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-5301
2026-10-03 Alias added: GHSA-24m3-w8g9-jwpq

References

Patch 1

https://github.com/simplesamlphp/simplesamlphp/commit/47968d26a2fd3ed52da70dc09210921d612ce44e

Advisory 2

Other 3

TI-2018-04801 The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which… CVSS 3.0CRITICAL 9.8
TI-2017-09530 The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and… CVSS 3.0CRITICAL 9.8
TI-2017-09535 SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive… CVSS 3.0CRITICAL 9.8
TI-2016-07944 The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and… CVSS 3.0CRITICAL 9.1
TI-2019-02593 Improper signature verification in Rob Richards XmlSecLibs CVSS 3.1HIGH 8.8
TI-2018-05557 HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect… CVSS 3.0HIGH 8.1

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences