CVE-2015-20108 — Vulnerability in ruby-saml — CVE Details
ruby-saml vulnerable to XPath injection
Summary
Advisory Timeline
- First published May 27, 2023 (1234 days ago).
- Last revised January 14, 2025 — 598 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
gem install ruby-saml -v 1.0.0
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (1)
Affects 1 ecosystem: rubygems (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| ruby-saml | rubygems | 0.0.5, 0.0.6, 0.0.7, 0.0.8 (+49 more) | 1.0.0 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-77
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-20108ADVISORY
- https://github.com/SAML-Toolkits/ruby-saml/pull/225WEB
- https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448WEB
- https://github.com/SAML-Toolkits/ruby-samlPACKAGE
- https://github.com/SAML-Toolkits/ruby-saml/compare/v0.9.2...v1.0.0WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2015-20108.ymlWEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/OSVDB-124991.ymlWEB
- https://security.netapp.com/advisory/ntap-20230703-0003WEB
- https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217WEB
Frequently Asked Questions
- What is CVE-2015-20108?
- ruby-saml vulnerable to XPath injection This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2015-20108?
- CVE-2015-20108 affects ruby-saml. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2015-20108 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2025-25291CRITICAL
Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)
- CVE-2025-25292CRITICAL
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)
- CVE-2024-45409CRITICAL
SAML authentication bypass via Incorrect XPath selector
- CVE-2025-66568CRITICAL
Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation
- CVE-2016-5697HIGH
Ruby-saml allows attackers to perform XML signature wrapping attacks
- CVE-2025-25293HIGH
Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses
- CVE-2017-11428HIGH
Ruby-SAML Improper Authentication vulnerability
- CVE-2025-54572MEDIUM
Ruby SAML DOS vulnerability with large SAML response
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies