high7.5
CVE-2018-20857
Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by <!---->.
Impact
Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by <!---->. and then the attacker's domain name.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zendesk | Samlr | before 2.6.2 |