CVE-2015-5215

MEDIUM 6.1CVE-2015-5215 · Published 17/02/2020 · updated 17/06/2026

In short

CVE-2015-5215 is a MEDIUM (CVSS 6.1) vulnerability affecting ipsilon (ipsilon-project).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.0% of all vulnerabilities.
Fix: update to 1.0.1 or later.

Package	Affected versions	Patched versions
ipsilon ipsilon-project	`≥ 0.1.0, < 1.0.1`	`1.0.1`

Description

The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via template variables. NOTE: This may be a duplicate of CVE-2015-5216. Moreover, the Jinja development team does not enable auto-escape by default for performance issues as explained in https://jinja.palletsprojects.com/en/master/faq/#why-is-autoescaping-not-the-default.

References

openwall.com/lists/oss-security/2015/10/23/10 · Mailing List
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
fedorahosted.org/ipsilon/wiki/Releases/v1.0.1 · Product
pagure.io/ipsilon/a503aa9c2a30a74e709d1c88099befd50fb2eb16 · Patch

More vulnerabilities in ipsilon

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free