-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure output encoding in template files (templates/temp-getcardform.php and templates/temp-login.php), where user-controlled parameters like $this->data['stateparams']['AuthState'], $this->data['username'], and $this->data['password'] were directly embedded into HTML without proper escaping (via htmlspecialchars()). While the commit diff shows the exact lines where XSS occurred, these are inline template rendering operations (echo statements) rather than discrete functions. The root cause is improper output encoding in template logic, not specific named functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| simplesamlphp/simplesamlphp-module-infocard | composer | < 1.0 | 1.0 |