CVE-2015-2684 Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.
MediumCVSS 4.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shibboleth service provider | <= 2.5.3 | No fix listed |
| debian linux | = 7.0 | No fix listed |
References
- DSA-3207 vendor-advisory
- 73314 vdb-entry
- shibboleth.net vendor-advisory