Description
xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/SAML-Toolkits/ruby-saml/pull/225 ↗
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/OSVDB-124991.yml ↗
- https://github.com/SAML-Toolkits/ruby-saml/compare/v0.9.2...v1.0.0 ↗
- https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448 ↗
- https://security.netapp.com/advisory/ntap-20230703-0003/ ↗