{"action":"Upgrade simplesamlphp/saml2 to 1.8.1 or later.","affected":[{"fixed":"1.10.3","introduced":"1.10"},{"fixed":"1.8.1","introduced":"0"},{"fixed":"1.9.1","introduced":"1.9.0"},{"fixed":"2.3.3","introduced":"2.0"}],"component":"simplesamlphp/saml2","cve_ids":["CVE-2016-9814"],"ecosystem":"Packagist","epss":0.02413,"exploited":false,"fixed_versions":["1.10.3","1.8.1","1.9.1","2.3.3"],"ghsa_id":"GHSA-r8v4-7vwj-983x","id":"tcs_01M5KF82X0YEFXMGFCA80NE824","modified_at":"2024-12-07T05:41:06.704001Z","published_at":"2022-05-14T03:40:37Z","references":["https://osv.dev/vulnerability/GHSA-r8v4-7vwj-983x","https://nvd.nist.gov/vuln/detail/CVE-2016-9814","https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/saml2/CVE-2016-9814.yaml","https://github.com/simplesamlphp/simplesamlphp","https://lists.debian.org/debian-lts-announce/2018/03/msg00001.html","https://simplesamlphp.org/security/201612-01","http://www.securityfocus.com/bid/94730"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-r8v4-7vwj-983x","url":"https://osv.dev/vulnerability/GHSA-r8v4-7vwj-983x"}],"summary":"SimpleSAMLphp SAML2 spoof SAML responses"}