CVE-2015-5215

The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable…

published February 17, 2020

CVSS
—
EPSS
1%
Percentile
64.5
In the wild
Unconfirmed
What it is

The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via template variables. NOTE: This may be a duplicate of CVE-2015-5216. Moreover, the Jinja development team does not enable auto-escape by default for performance issues as explained in https://jinja.palletsprojects.com/en/master/faq/#why-is-autoescaping-not-the-default.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01069 · 64.5th percentile
Published
2020-02-17T00:00Z
EPSS history
Timeline
  • 17 FEB 00:00Z
    The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable…
    cvelistv5