Critical severity · published Apr 17, 2019
CVE-2017-11428
OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate…
9.8
CVSS
2.5%
EPSS
No
On KEV
Description
OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
Ruby-saml · Onelogin
through 1.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-11428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-11428
Exploit
https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
Third Party Advisory
https://www.kb.cert.org/vuls/id/475445
More from Ruby-saml
9.8
CVE-2025-25292
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
9.8
CVE-2025-25291
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby
9.8
CVE-2024-45409
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
9.8
CVE-2015-20108
xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used
9.1
CVE-2025-66568
The ruby-saml library implements the client side of an SAML authorization