XPath Injection Affecting ruby-saml package, versions < 1.0.0


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RUBY-RUBYSAML-20217
  • published28 Apr 2015
  • disclosed28 Apr 2015
  • creditUnknown

Introduced: 28 Apr 2015

CVE NOT AVAILABLE CWE-91  (opens in a new tab)

Overview

ruby-saml is a SAML toolkit for Ruby on Rails.

Affected versions are vulnerable to XPath injection on xml_security.rb. The lack of prepared statements allows for possible command injection, leading to arbitrary code execution.

CVSS Base Scores

version 3.1