Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 23 Oct 2015 15:19:11 +0200
From: Patrick Uiterwijk <>
Subject: [CVE-2015-5215] Ipsilon: XSS in multiple pages

CVE-2015-5215: Ipsilon XSS in multiple pages

Versions affected: 0.1.0 to 1.0.0
Fixed in versions: 1.0.1, 1.1.0

It was found that the Ipsilon IdP server used the default configuration of the Jinja templating engine, which did not HTML escape template variables. This could be exploited to perform an XSS attack if a value from untrusted input was used in the template and rendered in the user`s browser.

Users of Ipsilon should update to version 1.0.1 or later.

This issue was discovered by Michael Scherer of Red Hat.


Patrick Uiterwijk
Fedora Infrastructure Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.