{"action":"Upgrade ruby-saml to 1.0.0 or later.","affected":[{"fixed":"1.0.0","introduced":"0"}],"component":"ruby-saml","cve_ids":["CVE-2015-20108"],"ecosystem":"RubyGems","epss":0.01332,"exploited":false,"fixed_versions":["1.0.0"],"ghsa_id":"GHSA-r364-2pj4-pf7f","id":"tcs_01M5KEN519N6Y0ZF7CAYSHQMHB","modified_at":"2025-01-14T22:26:10.295476Z","published_at":"2023-05-27T21:30:15Z","references":["https://osv.dev/vulnerability/GHSA-r364-2pj4-pf7f","https://nvd.nist.gov/vuln/detail/CVE-2015-20108","https://github.com/SAML-Toolkits/ruby-saml/pull/225","https://github.com/SAML-Toolkits/ruby-saml/commit/9853651b96b99653ea8627d757d46bfe62ab6448","https://github.com/SAML-Toolkits/ruby-saml","https://github.com/SAML-Toolkits/ruby-saml/compare/v0.9.2...v1.0.0","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2015-20108.yml","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/OSVDB-124991.yml","https://security.netapp.com/advisory/ntap-20230703-0003","https://security.snyk.io/vuln/SNYK-RUBY-RUBYSAML-20217"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-r364-2pj4-pf7f","url":"https://osv.dev/vulnerability/GHSA-r364-2pj4-pf7f"}],"summary":"ruby-saml vulnerable to XPath injection"}