Vendors / Pysaml2 Project Records 7 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 3
Exploited now Pysaml2 Project records in CISA KEV No Pysaml2 Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 44
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
CVSS 3.0 CRITICAL 9.0· Network · Low privileges · User interaction · EPSS 0.02616 · Published 2017-03-03 · Fixed in 4.5.0 CWE-611
Priority MEDIUM 41
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.05024 · Published 2017-03-24 · Partial fix · 4.5.0 CWE-611
Priority MEDIUM 40
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled.
CVSS 3.1 HIGH 8.1· Network · No auth · No interaction · EPSS 0.02553 · Published 2018-01-02 · Partial fix · 4.5.0 CWE-287
Priority LOW 35
PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW).
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01234 · Published 2020-01-13 · Partial fix · 5.0.0 CWE-347
Priority LOW 31
PySAML2 is a pure python implementation of SAML Version 2 Standard.
CVSS 3.1 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01291 · Published 2021-01-21 · Partial fix · 6.5.0 CWE-347
Priority LOW 31
PySAML2 is a pure python implementation of SAML Version 2 Standard.
CVSS 3.1 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01096 · Published 2021-01-21 · Partial fix · 6.5.0 CWE-347
Priority LOW 26
Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
CVSS 3.0 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00888 · Published 2017-11-17 · Partial fix · 4.6.0 CWE-330
Open these records in search → All records by CVSS severity
1 3 3 0 0
THREATIST.IORead the docs