CVE-2024-52596 HIGH

CVE-2024-52596: SimpleSAMLphp xml-common XXE vulnerability

Vendor Simplesamlphp
Product xml-common
Weakness CWE-611 · XXE
Published December 2, 2024
Last update December 2, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:N

What the vulnerability does

01Description

SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 1.19.0.

Key dates

02Disclosure timeline

December 2, 2024 CVE published
December 2, 2024 Record updated