CVE-2015-2684: Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.

PriorityP415medium4CVSS 2.0

AVNACLAuSCNINAP

EPSS

1.94%

78.1th percentile

Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
shibboleth	service_provider	<= 2.5.3	—

CVSS provenance

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P

osv4.0MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.