{"id":"CVE-2015-20108","published":"2023-05-27T00:00:00Z","modified":"2025-01-14T18:39:03Z","title":"xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared…","vendor":null,"product":null,"tier":"tail","description":{"text":"xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01332,"percentile":0.70991,"provenance":"source"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://github.com/SAML-Toolkits/ruby-saml/pull/225","tags":[]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/OSVDB-124991.yml","tags":[]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/compare/v0.9.2...v1.0.0","tags":[]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20230703-0003/","tags":[]}],"priority":{"score":21.1,"factors":[{"name":"EPSS percentile","points":14.2},{"name":"CVSS severity","points":6.86}]},"affected":[{"ecosystem":"RubyGems","package":"ruby-saml","vulnerableRanges":["<1.0.0"],"patched":["1.0.0"],"from":["GHSA-r364-2pj4-pf7f"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1617","exploited":false,"provenance":"source"}}