SSO Login is being implemented on this site. Existing users: Your existing password must be reset the first time you login using SSO. Click here to reset your password first before login. Your new username will be your email.

General Security & Cybersecurity Ecosystem


NIOS XML Vulnerability

[ Edited ]
Posts: 12
4245     1


A vulnerability in Infoblox NIOS may allow for an XML Bomb attack. The configuration for SAML authentication service for the application can be imported by a privileged user from an XML file without validation, potentially resulting in a Denial of Service (DOS).


The Infoblox NIOS application allows users to import authentication service configurations by parsing an XML file, without prior validation of the file’s content. This may be exploited by a malicious user by uploading an XML file with calls to recursive entities. The server will be delayed while parsing the content of the XML file, resulting in a DOS.


CVE: CVE-2020-15303

CVSSv3 Score: 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)


Affected NIOS Versions:

Affects NIOS versions which support SAML authentication. Specifically:

NIOS 8.4.0 through NIOS 8.4.8

NIOS 8.5.0,  NIOS 8.5.1





Infoblox addresses the CVE: CVE-2020-15303 vulnerability in NIOS 8.5.2. 


To eliminate the possibility of exploiting the above vulnerability, Infoblox strongly recommends  upgrading to NIOS 8.5.2 or above.

Showing results for 
Search instead for 
Did you mean: 

Recommended for You