{"id":"CVE-2015-5217","aliases":["EUVD-2015-0037","GHSA-6875-ff47-r6p6","PYSEC-2015-41"],"status":"published","title":"Ipsilon denial of service via a duplicate SP name","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.013,"percentile":0.70627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2015-11-17T15:00:00Z","modified":"2026-06-17T00:28:41Z","fixes":[{"ecosystem":"PyPI","package":"ipsilon","fixed_in":["1.0.1","1.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"ipsilon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ipsilon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"1.2.0"}]}]}],"products":[{"vendor":"ipsilon_project","product":"ipsilon"}],"references":[{"url":"https://pagure.io/ipsilon/826e6339441546f596320f3d73304ab5f7c10de6","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://fedorahosted.org/ipsilon/wiki/Releases/v1.0.1","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1255172","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/10/27/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5217","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ipsilon/PYSEC-2015-41.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6875-ff47-r6p6","tags":["advisory"]},{"url":"https://github.com/ipsilon-project/ipsilon","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-5217","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.","status":"published","published":"2015-11-17T15:00:00Z","modified":"2024-08-06T06:41:08.421Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-0037","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.","status":"published","published":"2015-11-17T15:00:00Z","modified":"2024-08-06T06:41:08Z","updated_at":"2026-11-03T02:22:01.305851Z"}],"ghsa":[{"id":"GHSA-6875-ff47-r6p6","title":"Ipsilon denial of service via a duplicate SP name","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.","status":"published","published":"2022-05-17T04:01:58Z","modified":"2024-11-22T20:20:14Z","updated_at":"2026-11-02T14:38:22.774145Z"}],"nvd":[{"id":"CVE-2015-5217","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.","status":"published","published":"2015-11-17T15:59:01.513Z","modified":"2026-06-17T00:28:41.67Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"GHSA-6875-ff47-r6p6","title":"Ipsilon denial of service via a duplicate SP name","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.","status":"published","published":"2022-05-17T04:01:58Z","modified":"2024-11-22T21:12:29.364012Z","updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"PYSEC-2015-41","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.","status":"withdrawn","published":"2015-11-17T15:59:00Z","modified":"2026-06-10T17:01:14.810879359Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}