{"id":"CVE-2018-6520","published":"2018-02-02T01:00:00Z","modified":"2024-08-05T06:10:10Z","title":"SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted…","vendor":null,"product":null,"tier":"tail","description":{"text":"SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00851,"percentile":0.58089,"provenance":"source"},"cwes":[],"references":[{"url":"https://simplesamlphp.org/security/201801-02","tags":["x_refsource_CONFIRM"]}],"priority":{"score":11.6,"factors":[{"name":"EPSS percentile","points":11.62}]},"affected":[{"ecosystem":"Packagist","package":"simplesamlphp/simplesamlphp","vulnerableRanges":["<1.15.2"],"patched":["1.15.2"],"from":["GHSA-2qfc-48v5-4w5h"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2034","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-18121","published":"2018-02-02","fixed":"1.14.16","kev":false},{"cve":"CVE-2017-18122","published":"2018-02-02","fixed":"1.14.17","kev":false},{"cve":"CVE-2017-12872","published":"2017-09-01","fixed":"1.15.0-rc1","kev":false,"link":{"from":"CVE-2017-12872","to":"CVE-2018-6520","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:simplesamlphp/simplesamlphp","fromFixed":"1.15.0-rc1","toFixed":"1.15.2","daysApart":154}]}},{"cve":"CVE-2018-6520","published":"2018-02-02","fixed":"1.15.2","kev":false},{"cve":"CVE-2018-6521","published":"2018-02-02","fixed":"1.15.2","kev":false},{"cve":"CVE-2020-5225","published":"2020-01-24","fixed":"1.18.4","kev":false,"link":{"from":"CVE-2018-6520","to":"CVE-2020-5225","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:simplesamlphp/simplesamlphp","fromFixed":"1.15.2","toFixed":"1.18.4","daysApart":721}]}},{"cve":"CVE-2020-5226","published":"2020-01-24","fixed":"1.18.4","kev":false}],"package":"Packagist:simplesamlphp/simplesamlphp"}}