CVE-2016-10149

High

Published: 24/03/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The XXE vulnerability in PySAML2 version 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.

Risk Assessment

Attackers may gain access to sensitive data on the server, potentially leading to serious security breaches.

Recommendation

It is recommended to upgrade to the latest version of PySAML2 to mitigate this vulnerability.

Other vulnerabilities in PySAML2

CVE-2016-10127Critical
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

Original NVD description (English source)

XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.