Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2024-52806

SimpleSAMLphp SAML2 has an XXE in parsing SAML messages

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

simplesamlphp saml2

  • < 4.6.14affected
  • >= 5.0.0-alpha.1, < 5.0.0-alpha.18affected

References