CVE-2015-20108

CRITICAL EPSS 67.6%
Published May 27, 20233y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published May 27, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
67.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-77 Command Injection Injection

Affected Products 1

VendorProductVersionRange
oneloginruby-saml* <1.0.0

References 5

  • github.com https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448
    Patch
  • github.com https://github.com/SAML-Toolkits/ruby-saml/compare/v0.9.2...v1.0.0
    Patch
  • github.com https://github.com/SAML-Toolkits/ruby-saml/pull/225
    Issue Tracking
  • github.com https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/OSVDB-124991.yml
    Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20230703-0003/

Remediation

  • github.com https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448
    Patch
  • github.com https://github.com/SAML-Toolkits/ruby-saml/compare/v0.9.2...v1.0.0
    Patch