{"id":"CVE-2018-6521","published":"2018-02-02T01:00:00Z","modified":"2024-08-05T06:10:09Z","title":"The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon…","vendor":null,"product":null,"tier":"tail","description":{"text":"The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03053,"percentile":0.87527,"provenance":"source"},"cwes":[],"references":[{"url":"https://simplesamlphp.org/security/201801-03","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00008.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2018/dsa-4127","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":17.5,"factors":[{"name":"EPSS percentile","points":17.51}]},"affected":[{"ecosystem":"Packagist","package":"simplesamlphp/simplesamlphp","vulnerableRanges":["<1.15.2"],"patched":["1.15.2"],"from":["GHSA-qv5p-6wrc-79wg"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5030","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-18122","published":"2018-02-02","fixed":"1.14.17","kev":false},{"cve":"CVE-2017-12872","published":"2017-09-01","fixed":"1.15.0-rc1","kev":false,"link":{"from":"CVE-2017-12872","to":"CVE-2018-6521","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:simplesamlphp/simplesamlphp","fromFixed":"1.15.0-rc1","toFixed":"1.15.2","daysApart":154}]}},{"cve":"CVE-2018-6520","published":"2018-02-02","fixed":"1.15.2","kev":false},{"cve":"CVE-2018-6521","published":"2018-02-02","fixed":"1.15.2","kev":false},{"cve":"CVE-2020-5225","published":"2020-01-24","fixed":"1.18.4","kev":false},{"cve":"CVE-2020-5226","published":"2020-01-24","fixed":"1.18.4","kev":false},{"cve":"CVE-2020-5301","published":"2020-04-21","fixed":"1.18.6","kev":false}],"package":"Packagist:simplesamlphp/simplesamlphp"}}