CVE-2017-12873: debian debian_linux Session Fixation
Modified
AliasesUBUNTU-CVE-2017-12873DEBIAN-CVE-2017-12873
Published 01-09-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-12873 is a critical (CVSS 9.8) Session Fixation vulnerability in debian debian_linux. EPSS estimates a 1.66% chance of exploitation in the next 30 days, higher than 76.3% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.0 (NVD)EPSS score
1.66%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 01-09-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.
CVSS metrics
4 scores · 3 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.66%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.66% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- simplesamlphp< 1.14.11-1
- debian_linuxEOL7.0 | 8.0 | 9.0
Simplesamlphp1 product
- simplesamlphp≥ 1.7.0, ≤ 1.14.10
Ubuntu1 product
- simplesamlphpAll versions (No fix recorded)
3 vendors · 4 products
References
7 links- github.com/simplesamlphp/simplesamlphp/commit/90dca835158495b173808273e7df127303b8b953X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2017/12/msg00007.htmlMailing ListX Refsource MLISTThird Party Advisory