CVE Catalog
CVE-2016-10127
CriticalSummary
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
Risk Assessment
XXE attacks can lead to the disclosure of sensitive data and may also facilitate attacks on other services within the organization's internal network.
Recommendation
It is recommended to update PySAML2 to the latest version and implement appropriate defenses against XXE attacks.
Original NVD description (English source)
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.