Ipsilon denial of service by deleting a SAML2 Service Provider (SP)

CVE-2015-5301 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).

Basic information

Type: reviewed
Severity: medium
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2022-05-17 03:27:18 UTC
Updated: 2024-11-22 20:20:09 UTC
GitHub reviewed: 2024-11-22 20:20:08 UTC
NVD published: 2015-11-17

EPSS Score

Score	Percentile
0.66%	70.50%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type	Value
GHSA	GHSA-9qp4-79q8-58pr ↗
CVE	CVE-2015-5301 ↗

Affected packages (2)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
pip	ipsilon	>= 0.1.0, < 1.0.2	1.0.2	—
pip	ipsilon	>= 1.1.0, < 1.1.1	1.2.0	—

References

cvelogic Threat Intelligence