{"items":[{"id":"NVI-00007194","kind":"vulnerability","title":"SimpleSAMLphp Information Disclosure vulnerability","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-ppm4-r2vc-pg74"],"plain_summary":"OSV carries this publisher advisory for simplesamlphp/simplesamlphp. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.17.8 for simplesamlphp/simplesamlphp. Confirm the publisher’s latest guidance.","source_ids":["sr-d2a33aea78db26020a7683ebc2ae0945"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d2a33aea78db26020a7683ebc2ae0945","url":"https://github.com/advisories/GHSA-ppm4-r2vc-pg74","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-ppm4-r2vc-pg74","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.993Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d2a33aea78db26020a7683ebc2ae0945"],"technology":"simplesamlphp/simplesamlphp","known_exclusions":[],"conditions_summary":"### Background\nSimpleSAMLphp 1.17 includes a preview of the new user interface to be included in the future version 2.0. This new user interface can be enabled by setting the usenewui configuration option to true, and it includes a new admin interface in a module called admin, which can be disabled.\n\n### Description\nThe new admin interface includes a way to view information about the host where SimpleSAMLphp is installed, by means of the phpinfo() PHP function. An endpoint that exposes the output of that function is included in the admin module for easier debugging.\n\nThe aforementioned endpoint had no checks for administrator privileges. This would allow any individual to access the given endpoint without authenticating, gathering information about the affected system.\n\n### Affected versions\nAll SimpleSAMLphp 1.17 versions up to 1.17.7 are affected, provided that the new, experimental use interface is enabled, together with the new admin module.\n\n### Impact\nAn attacker could leverage this issue by accessing the unprotected endpoint and gather intelligence about the host where SimpleSAMLphp is deployed, using it later for their own advantage in case other issues arise.\n\nHowever, the","public_affected_ranges":["ECOSYSTEM: introduced 1.17.0; fixed 1.17.8"]}],"null_published_at":"2026-10-31T22:13:14.316Z","source_updated_at":"2024-12-03T06:03:46.285Z","source_disclosed_at":"2024-05-28T21:26:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:30.993Z"}],"next_cursor":null,"snapshot_revision":"42594"}