-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of user-supplied parameters ('link_href' and 'retryURL') in the scripts www/logout.php and modules/core/www/no_cookie.php. These scripts directly process HTTP request parameters and pass them to the normalization function \SimpleSAML\Utils\HTTP::normalizeURL() without validation. However, the vulnerability does not reside in a specific named function but in the procedural flow of these scripts. The lack of validation (via checkURLAllowed) in the parameter-handling logic allowed arbitrary URLs to be injected. Since the vulnerable code exists at the script level rather than within defined functions, no specific functions are identified as the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| simplesamlphp/simplesamlphp | composer | < 1.14.4 | 1.14.4 |