CVE-2016-10127

CRITICAL

PySAML2 < 4.5.0 - XML External Entity Injection via SAML XML Request or Response

Title source: llm
STIX 2.1

Description

PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

References (6)

Core 6
Core References
Issue Tracking, Patch x_refsource_misc
https://github.com/rohe/pysaml2/issues/366
Issue Tracking, Patch x_refsource_misc
https://github.com/rohe/pysaml2/pull/379
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2017/01/19/5
VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95376
Mailing List, Third Party Advisory x_refsource_misc
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716

Scores

CVSS v3 9.0
EPSS 0.0213
EPSS Percentile 79.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-611
Status published
Products (2)
pypi/pysaml2 0 - 4.5.0PyPI
pysaml2_project/pysaml2
Published Mar 03, 2017
Tracked Since Feb 18, 2026