CVE-2015-5217

2015-11-1715:59:01

CWE-264

[email protected]

web.nvd.nist.gov

cve-2015-5217

ipsilon

identity provider

saml2

denial of service

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

5.8 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.3%

JSON

providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.

Affected configurations

NVD

Node

ipsilon_projectipsilonMatch0.1.0

ipsilon_projectipsilonMatch0.3.0

ipsilon_projectipsilonMatch0.4.0

ipsilon_projectipsilonMatch0.5.0

ipsilon_projectipsilonMatch0.6.0

ipsilon_projectipsilonMatch1.0.0

CPENameOperatorVersion
ipsilon_project:ipsilonipsilon project ipsiloneq0.1.0
ipsilon_project:ipsilonipsilon project ipsiloneq0.3.0
ipsilon_project:ipsilonipsilon project ipsiloneq0.4.0
ipsilon_project:ipsilonipsilon project ipsiloneq0.5.0
ipsilon_project:ipsilonipsilon project ipsiloneq0.6.0
ipsilon_project:ipsilonipsilon project ipsiloneq1.0.0

CPE	Name	Operator	Version
ipsilon_project:ipsilon	ipsilon project ipsilon	eq	0.1.0
ipsilon_project:ipsilon	ipsilon project ipsilon	eq	0.3.0
ipsilon_project:ipsilon	ipsilon project ipsilon	eq	0.4.0
ipsilon_project:ipsilon	ipsilon project ipsilon	eq	0.5.0
ipsilon_project:ipsilon	ipsilon project ipsilon	eq	0.6.0
ipsilon_project:ipsilon	ipsilon project ipsilon	eq	1.0.0