CVE-2015-5301
Ipsilon denial of service by deleting a SAML2 Service Provider (SP)
CVE-2015-5301 is a medium vulnerability (CVSS 5.5) in Ipsilon Project Ipsilon, published November 17, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in ipsilon 1.0.2.
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Exploit likelihood
What each source reports
NVD Score used
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
- Record
CVE-2015-5301- CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
- Record
CVE-2015-5301- Updated
- 2026-11-02
EUVDEUVD-2015-0038 No score
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
- Record
EUVD-2015-0038- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9qp4-79q8-58pr No score
Ipsilon denial of service by deleting a SAML2 Service Provider (SP)
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
- Record
GHSA-9qp4-79q8-58pr- Updated
- 2026-11-02
OSVGHSA-9qp4-79q8-58pr No score
Ipsilon denial of service by deleting a SAML2 Service Provider (SP)
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
- Record
GHSA-9qp4-79q8-58pr- Updated
- 2026-11-02
OSVPYSEC-2015-42 No score
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
- Record
PYSEC-2015-42- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
fedorahosted.org/ipsilon/wiki/Releases/v1.0.2
lists.fedoraproject.org/pipermail/package-announce/2015-November/171076.html
openwall.com/lists/oss-security/2015/10/27/8