-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped output of the StateID parameter in trust.tpl.php. The commit diff shows the fix adds htmlspecialchars() around $this->data['StateID'], indicating the original echo statement was vulnerable to XSS. The template directly embeds user-controlled input into HTML without sanitization, making it susceptible to script injection. This matches the CWE-79 description and the vulnerability's XSS nature.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| simplesamlphp/simplesamlphp-module-openidprovider | composer | < 0.9.0 | 0.9.0 |
Ongoing coverage of React2Shell