Description
Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the link_href parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | simplesamlphp | 1.8.2-1 | — |
| Debian 12 | simplesamlphp | 1.8.2-1 | — |
| Debian 6.0 | simplesamlphp | 1.6.3-3 | DSA-2387-1 |
Advisories 1
- DSA-2387-1 simplesamlphp - cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- simplesamlphp-nocookie-logout-xss(72313) vdb-entry
- http://code.google.com/p/simplesamlphp/issues/detail?id=468
- 78255 vdb-entry
- [oss-security] 20120120 Re: CVE request: simpleSAMLphp 1.8.2 cross site scripting mailing-list
- 51372 vdb-entry
- 47491 third-party-advisory