{"id":"CVE-2015-5301","aliases":["EUVD-2015-0038","GHSA-9qp4-79q8-58pr","PYSEC-2015-42"],"status":"published","title":"Ipsilon denial of service by deleting a SAML2 Service Provider (SP)","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).","severity":{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01493,"percentile":0.74334,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2015-11-17T15:00:00Z","modified":"2026-06-17T00:28:51Z","fixes":[{"ecosystem":"PyPI","package":"ipsilon","fixed_in":["1.0.2","1.1.1","1.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"ipsilon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"1.0.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"ipsilon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ipsilon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ipsilon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.2.0"}]}]}],"products":[{"vendor":"ipsilon_project","product":"ipsilon"}],"references":[{"url":"https://fedorahosted.org/ipsilon/wiki/Releases/v1.0.2","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171076.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171052.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171067.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/10/27/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://fedorahosted.org/ipsilon/wiki/Releases/v1.1.1","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://pagure.io/ipsilon/9dec97c3c83928d231ea10f4160523a13803e594","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271530","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5301","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ipsilon/PYSEC-2015-42.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9qp4-79q8-58pr","tags":["advisory"]},{"url":"https://github.com/ipsilon-project/ipsilon","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-5301","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).","status":"published","published":"2015-11-17T15:00:00Z","modified":"2024-08-06T06:41:09.52Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-0038","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).","status":"published","published":"2015-11-17T15:00:00Z","modified":"2024-08-06T06:41:09Z","updated_at":"2026-11-03T02:22:00.863884Z"}],"ghsa":[{"id":"GHSA-9qp4-79q8-58pr","title":"Ipsilon denial of service by deleting a SAML2 Service Provider (SP)","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).","status":"published","published":"2022-05-17T03:27:18Z","modified":"2024-11-22T20:20:09Z","updated_at":"2026-11-02T14:38:22.774145Z"}],"nvd":[{"id":"CVE-2015-5301","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).","status":"published","published":"2015-11-17T15:59:06.263Z","modified":"2026-06-17T00:28:51.203Z","cvss":[{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"GHSA-9qp4-79q8-58pr","title":"Ipsilon denial of service by deleting a SAML2 Service Provider (SP)","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).","status":"published","published":"2022-05-17T03:27:18Z","modified":"2024-11-22T20:27:26.509655Z","updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"PYSEC-2015-42","description":"providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).","status":"withdrawn","published":"2015-11-17T15:59:00Z","modified":"2026-06-10T17:01:14.765058183Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}