CVE-2020-5225 json
Log injection in SimpleSAMLphp
published 2020-01-24 6 y ago modified 2026-09-10 1 mo ago also GHSA-6gc6-m364-85ww , EUVD-2020-0249
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the reportID parameter received in a request sent to www/errorreport.php was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.
Patch / fix
- packagist simplesamlphp/simplesamlphp 1.18.4
- simplesamlphp simplesamlphp 1.18.4
- simplesamlphp Debian 14, Debian 12 1.18.4-1
debian advisories DEBIAN-CVE-2020-5225
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVD | 2.0 | 5.5 | AV:N/AC:L/Au:S/C:P/I:P/A:N |
| GitHub | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | simplesamlphp/simplesamlphp | <1.18.4 |
1.18.4 |
Affected products
- simplesamlphp SimpleSAMLphp
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
References
-
simplesamlphp.org
/security/202001-02
web, vendor-advisory
-
github.com
/simplesamlphp/simplesamlphp/security/advisories/GHSA-6gc6-m364-85ww
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-5225
advisory
Sources
- CVE List CVE-2020-5225
- GitHub Advisory GHSA-6gc6-m364-85ww
- NVD CVE-2020-5225
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.