CVE-2015-5215
ipsilon: XSS in multiple pages
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · August 19, 2015
Updated · November 22, 2025
Description
It was found that the Ipsilon IdP server used the default configuration of the Jinja templating engine, which did not HTML escape template variables. This could be exploited to perform an XSS attack if a value from untrusted input was used in the template and rendered in the user`s browser.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')