CVE-2024-52596

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 1.19.0.

Metrics

CVSS 4.0 8.8/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
simplesamlphp	xml-common	< 1.20.0
simplesamlphp	xml-common	< 1.20.0

References

Timeline

Published: Dec 2, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-525976.12FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulner CVE-2024-525987.52FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities CVE-2024-525995.4Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to versio CVE-2024-52605.4The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plu CVE-2024-526005.3Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted CVE-2024-526016.5iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can CVE-2024-526025.3Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to serv CVE-2024-526069.8SolarWinds Platform is affected by server-side request forgery vulnerability. Proper input sanitation was not applied allowing for the possi CVE-2024-52619.8Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit c CVE-2024-526113.5The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide a CVE-2024-526124.8SolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input CVE-2024-526135.5A heap-based buffer under-read in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) via a crafte