SimpleSAMLphp xml-common XXE vulnerability
Priority MEDIUM 46CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 1.19.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00979 62nd percentileScored 2026-11-07
Fix Fixed xml-common (simplesamlphp): 1.20.0simplesamlphp/xml-common (Packagist): 1.20.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| simplesamlphp | xml-common | before 1.20.0 | 1.20.0 | Patch available | CNA |
| — | simplesamlphp/xml-common (Packagist) | before 1.20.0 | 1.20.0 | Patch available | GHSA-2x65-fpch-2fcm |
- xml-common Vendorsimplesamlphp Affected before 1.20.0 Fixed in 1.20.0 Patch available CNA
- simplesamlphp/xml-common (Packagist) Vendor— Affected before 1.20.0 Fixed in 1.20.0 Patch available GHSA-2x65-fpch-2fcm
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:simplesamlphp:xml-common:*:*:*:*:*:*:*:* | — | — | simplesamlphp |
- cpe:2.3:a:simplesamlphp:xml-common:*:*:*:*:*:*:*:* Versions — — ·simplesamlphp
Remediation
- Fix · CNA xml-common (simplesamlphp) Fixed in 1.20.0
- Fix · GHSA-2x65-fpch-2fcm simplesamlphp/xml-common (Packagist) Fixed in 1.20.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-52596
- 2026-10-03 Alias added: GHSA-2x65-fpch-2fcm
References
More simplesamlphp vulnerabilities
- TI-2025-20553 SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding CVSS 3.1HIGH 8.6
- TI-2026-25110 xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVSS 3.1HIGH 8.2
- TI-2025-40522 SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout CVSS 3.1MEDIUM 6.1
- TI-2018-04801 The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which… CVSS 3.0CRITICAL 9.8
- TI-2017-09530 The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and… CVSS 3.0CRITICAL 9.8
- TI-2017-09535 SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2024-52596 · CVE Program
- CVE-2024-52596 · NVD
- FIRST EPSS
- GHSA-2x65-fpch-2fcm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences