CVE-2016-3124
SimpleSAMLphp Information leakage issue in the sanitycheck module
CVE-2016-3124 is a medium vulnerability (CVSS 5.3) in Simplesamlphp, published February 7, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in simplesamlphp/simplesamlphp 1.14.1.
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
- Record
CVE-2016-3124- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
- Record
CVE-2016-3124- Updated
- 2026-11-02
EUVDEUVD-2022-3280 No score
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
- Record
EUVD-2022-3280- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9327-mqm6-x97j
SimpleSAMLphp Information leakage issue in the sanitycheck module
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
- Record
GHSA-9327-mqm6-x97j- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
- Record
CVE-2016-3124- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-3124
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
- Record
DEBIAN-CVE-2016-3124- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-9327-mqm6-x97j
SimpleSAMLphp Information leakage issue in the sanitycheck module
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
- Record
GHSA-9327-mqm6-x97j- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-3124
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
- Record
UBUNTU-CVE-2016-3124- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
simplesamlphp/simplesamlphpPackagist |
before 1.14.1 | 1.14.1 |
simplesamlphpDebian:12 |
before 1.14.1-1 | 1.14.1-1 |
simplesamlphpDebian:14 |
before 1.14.1-1, plus listed versions 1.10.0-11.11.0-11.12.0-11.12.0~rc1-11.12.0~rc2-1 Show 21 moreShow less1.13.0-11.13.1-11.13.1-21.13.2-11.14.0-11.6.0-11.6.1-11.6.2-11.6.3-11.6.3-21.6.3-31.7.0-11.7.0-21.8.0-11.8.1-11.8.2-11.9.0-11.9.0~rc1-11.9.0~rc2-11.9.1-11.9.2-1 |
1.14.1-1 |
simplesamlphp/simplesamlphpPackagist |
before 1.14.1, plus listed versions v1.12.0v1.13.0v1.13.0-rc1v1.13.0-rc2v1.13.1v1.13.2v1.14.0v1.14.0-rc1 |
1.14.1 |
simplesamlphpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.13.2-11.14.0-11.14.0-1ubuntu21.14.0-1ubuntu2+esm1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |