CVE-2024-52806 HIGH

CVE-2024-52806: SimpleSAMLphp SAML2 has an XXE in parsing SAML messages

Vendor Simplesamlphp
Product saml2
Weakness CWE-611 · XXE
Published December 2, 2024
Last update December 2, 2024
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.

Key dates

02Disclosure timeline

December 2, 2024 CVE published
December 2, 2024 Record updated