CVE-2010-10008: Simplesamlphp/simplesamlphp module openidprovider Simplesamlphp-module-openidprovider Cross Site Scripting Vulnerability Vulnerability
MODERATECVE-2010-10008 is a MODERATE (CVSS 5.4) simplesamlphp-module-openidprovider cross site scripting vulnerability vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Simplesamlphp/simplesamlphp module openidprovider libraries in the Packagist ecosystem. The issue involves simplesamlphp-module-openidprovider cross site scripting vulnerability. Remediation is available by upgrading affected packages to version 0.9.0.
CVE-2010-10008 at a Glance
Security Impact
CVSS: 5.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
How to Fix CVE-2010-10008
To remediate this vulnerability, upgrade all affected Simplesamlphp/simplesamlphp module openidprovider dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade simplesamlphp/simplesamlphp-module-openidprovider to 0.9.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for simplesamlphp/simplesamlphp-module-openidproviderHow to Check if You Are Affected
To determine whether your application is affected by CVE-2010-10008, inspect your project dependencies for Simplesamlphp/simplesamlphp module openidprovider:
inspect dependencies for simplesamlphp/simplesamlphp-module-openidproviderAnalyze the terminal output to locate any version of Simplesamlphp/simplesamlphp module openidprovider in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.9.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Simplesamlphp/simplesamlphp module openidprovider, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2010-10008 Affected Simplesamlphp/simplesamlphp module openidprovider Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
simplesamlphp/simplesamlphp-module-openidprovider
|
Packagist |
< 0.9.0
|
0.9.0
|
References
Frequently Asked Questions
What is CVE-2010-10008?
Which Simplesamlphp/simplesamlphp module openidprovider versions are affected?
What version fixes CVE-2010-10008?
Is simplesamlphp/simplesamlphp-module-openidprovider affected?
What is the CVSS score of CVE-2010-10008?
What CWE is associated with CVE-2010-10008?
How can I check Packagist dependencies for CVE-2010-10008?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-chgc-rqjr-46gg",
"modified" : "2024-03-01T14:28:08Z",
"published" : "2023-01-17T09:30:24Z",
"aliases" : [ "CVE-2010-10008" ],
"summary" : "simplesamlphp-module-openidprovider Cross Site Scripting vulnerability",
"details" : "A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file templates/trust.tpl.php. The manipulation of the argument StateID leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.9.0 is able to address this issue. The name of the patch is 8365d48c863cf06ccf1465cc0a161cefae29d69d. It is recommended to upgrade the affected component. The identifier VDB-218473 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. ",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "simplesamlphp/simplesamlphp-module-openidprovider"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.9.0"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2010-10008"
}, {
"type" : "WEB",
"url" : "https://github.com/simplesamlphp/simplesamlphp-module-openidprovider/commit/8365d48c863cf06ccf1465cc0a161cefae29d69d"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/simplesamlphp/simplesamlphp-module-openidprovider"
}, {
"type" : "WEB",
"url" : "https://github.com/simplesamlphp/simplesamlphp-module-openidprovider/releases/tag/v0.9.0"
}, {
"type" : "WEB",
"url" : "https://vuldb.com/?ctiid.218473"
}, {
"type" : "WEB",
"url" : "https://vuldb.com/?id.218473"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2023-01-25T02:56:08Z",
"nvd_published_at" : "2023-01-17T08:15:00Z"
}
}