{"id":"CVE-2011-4625","aliases":["DEBIAN-CVE-2011-4625","DSA-2330-1","EUVD-2022-1634","GHSA-5fj7-f8x3-q2mc"],"status":"published","title":"simpleSAMLphp incorrectly handles XML encryption","description":"simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00744,"percentile":0.55012,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-755"],"published":"2011-10-27T00:00:00Z","modified":"2026-10-23T18:03:52Z","fixes":[{"ecosystem":"Packagist","package":"simplesamlphp/simplesamlphp","fixed_in":["1.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"simplesamlphp","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"simplesamlphp","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"simplesamlphp","fixed_in":["1.6.3-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"simplesamlphp/simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}],"versions":["1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.3-2","1.6.3-3","1.7.0-1","1.7.0-2","1.8.0-1"]},{"source":"osv","ecosystem":"Debian:6.0","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-2"}]}],"versions":["1.6.3-1"]},{"source":"osv","ecosystem":"Packagist","package":"simplesamlphp/simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"simplesamlphp","product":"simplesamlphp"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2011-4625","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.mageni.net/1.3.6.1.4.1.25623.1.0.70545","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4625","tags":["advisory"]},{"url":"https://github.com/simplesamlphp/simplesamlphp/blob/b3059c51a915910c6631fb2ee597c0fb6ad9162b/docs/simplesamlphp-changelog-1.x.md?plain=1#L1624","tags":["web"]},{"url":"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202330-1","tags":["web"]},{"url":"https://www.mageni.net/vulnerability/debian-security-advisory-dsa-2330-1-simplesamlphp-70545","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5fj7-f8x3-q2mc"},{"url":"https://github.com/simplesamlphp/simplesamlphp","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2011-4625","description":"simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.","status":"published","published":"2019-11-06T14:53:31Z","modified":"2024-08-07T00:09:19.359Z","updated_at":"2026-11-02T14:35:37.989579Z"}],"euvd":[{"id":"EUVD-2022-1634","description":"simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.","status":"published","published":"2019-11-06T14:53:31Z","modified":"2024-08-07T00:09:19Z","updated_at":"2026-11-03T01:39:48.540824Z"}],"ghsa":[{"id":"GHSA-5fj7-f8x3-q2mc","title":"simpleSAMLphp incorrectly handles XML encryption","description":"simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.","status":"published","published":"2022-04-22T00:24:09Z","modified":"2024-01-12T23:10:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:37:30.812736Z"}],"nvd":[{"id":"CVE-2011-4625","description":"simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.","status":"published","published":"2019-11-06T15:15:10.627Z","modified":"2026-06-16T23:35:10.157Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:02:12.945371Z"}],"osv":[{"id":"CVE-2011-4625","description":"simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.","status":"published","published":"2019-11-06T15:15:10Z","modified":"2026-04-10T03:42:06.755019Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-4625","description":"simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.","status":"published","published":"2019-11-06T15:15:10.627Z","modified":"2026-10-23T18:03:52.129711871Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"GHSA-5fj7-f8x3-q2mc","title":"simpleSAMLphp incorrectly handles XML encryption","description":"simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.","status":"published","published":"2022-04-22T00:24:09Z","modified":"2024-01-12T23:26:48.7326Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"DSA-2330-1","title":"simplesamlphp - several","status":"published","published":"2011-10-27T00:00:00Z","modified":"2026-03-09T01:20:28.668755Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}