{"id":"CVE-2015-20108","aliases":["DEBIAN-CVE-2015-20108","EUVD-2023-1617","GHSA-r364-2pj4-pf7f","UBUNTU-CVE-2015-20108"],"status":"published","title":"ruby-saml vulnerable to XPath injection","description":"xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01332,"percentile":0.71293,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2023-05-27T00:00:00Z","modified":"2026-09-09T07:00:36Z","fixes":[{"ecosystem":"RubyGems","package":"ruby-saml","fixed_in":["1.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-saml","fixed_in":["1.0.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}],"versions":["0.0.5","0.0.6","0.0.7","0.0.8","0.2.1","0.2.2","0.2.3","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.5.0","0.5.1","0.5.2","0.5.3","0.6.0","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.10","0.8.11","0.8.12","0.8.13","0.8.14","0.8.15","0.8.16","0.8.17","0.8.18","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9","0.9.1","0.9.2","0.9.3","0.9.4"]}],"products":[{"vendor":"onelogin","product":"ruby-saml"}],"references":[{"url":"https://github.com/SAML-Toolkits/ruby-saml/pull/225","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/OSVDB-124991.yml","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/compare/v0.9.2...v1.0.0","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20230703-0003/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-20108","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2015-20108.yml","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20230703-0003","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r364-2pj4-pf7f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-20108","tags":["advisory"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2015-20108","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-20108","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-20108","description":"xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","status":"published","published":"2023-05-27T00:00:00Z","modified":"2025-01-14T18:39:03.44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:35:39.447402Z"}],"euvd":[{"id":"EUVD-2023-1617","description":"xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","status":"published","published":"2023-05-27T00:00:00Z","modified":"2025-01-14T18:39:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:19.424496Z"}],"ghsa":[{"id":"GHSA-r364-2pj4-pf7f","title":"ruby-saml vulnerable to XPath injection","description":"`xml_security.rb` in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","status":"published","published":"2023-05-27T21:30:15Z","modified":"2025-01-14T22:14:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:38:27.067633Z"}],"nvd":[{"id":"CVE-2015-20108","description":"xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","status":"published","published":"2023-05-27T19:15:09.043Z","modified":"2026-06-17T00:23:24.22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:03:20.037729Z"}],"osv":[{"id":"CVE-2015-20108","description":"xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","status":"published","published":"2023-05-27T19:15:09Z","modified":"2026-04-10T03:45:11.885913Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-20108","description":"xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","status":"published","published":"2023-05-27T19:15:09.043Z","modified":"2026-09-09T07:00:36.77360782Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-r364-2pj4-pf7f","title":"ruby-saml vulnerable to XPath injection","description":"`xml_security.rb` in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","status":"published","published":"2023-05-27T21:30:15Z","modified":"2025-01-14T22:26:10.295476Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"UBUNTU-CVE-2015-20108","description":"xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.","status":"withdrawn","published":"2023-05-27T19:15:00Z","modified":"2025-07-16T07:32:42.771243Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:10.045446Z"}]}}