The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

The Command Platform

Respond faster and outpace attackers. Taking command of your attack surface starts here.

Explore platform

Capabilities

Attack Surface Management
Reveal & protect coverage gaps
Exposure Management
Identify & remediate at-risk data
Vulnerability Management
Pinpoint & eliminate risk
CyberGRC
Manage governance, risk & compliance

Next-Gen SIEM
Investigate with AI-driven detections
Threat Intelligence Platform
Recognize & mitigate adversaries
AI-Powered Security Operations
Automate & optimize workflows
Cloud-Native Application Protection
Discover & defend sensitive data
Application Security
Scan & simplify dev workflows

Explore the platform

Talk to an Expert
Product Tours
Customer Stories

All Products

MDR Services

Managed Detection and Response
Preemptive MDR that disrupts attackers
MDR for Microsoft
Maximize and protect your Microsoft investment
MDR for Enterprise
Get customized protection for enterprise systems
MDR ROI Calculator
See how MDR can boost your ROI

Rapid7 MDR vs. Competitors
Decide which solution fits

Exposure Management

Managed Vulnerability Management
Get help pinpointing exposures
Continuous Red Teaming
Get help validating exposures
Managed Application Security
Get help securing dev workflows
Penetration Testing Services
Get help with defense assessment

All services

Intelligence

Rapid7 Intelligence tracks adversaries, shares proprietary, curated intelligence and research, and builds trusted open-source communities—all to help you improve your security program.

Explore Rapid7 Intelligence

Research and Intelligence

Latest Threat Research
Proprietary intelligence, research and adversary insights
Emergent Threat Response
Fast, expert analysis and security content for high-priority cyber threats

Tools and Services

Vulnerability & Exploit Database
Search thousands of CVEs
Metasploit
The world's most used penetration testing tool
Velociraptor
Endpoint monitoring, digital forensic and cyber response platform
Project Sonar
Improve security through the active analysis of public networks
Threat Intelligence Platform
Transform raw threat data into curated, high-fidelity intelligence

Learn

Blog
Webinars and Events
Resource Library
Cybersecurity Fundamentals

Product

Product Documentation
Product Release Notes
Product Extensions
Product Toolkits

Customer Support

Customer Support
Rapid7 Forum

Partner With Rapid7

Partnerships Overview
PACT Partner Program
Expand & enrich customer experience
PACT for Service Providers
Unlock SOC efficiencies

For Customers

Partner Directory
Find Resellers, MSSPs and Distributors
Technology Partners
Strengthen your security stack
AWS Partnership
Secure AWS resource types

Partner portal

Partner Login
Become a Partner
Develop & win business

Company

About Us
Leadership Team
Our Customers
Careers
Contact Us

Media

Newsroom
Awards and Recognition
Investors

In the community

Social Good
Culture
Boston Bruins Partnership

Contact

Get demo

The Command Platform
Respond faster and outpace attackers. Taking command of your attack surface starts here.
Explore platform
Capabilities
Attack Surface Management
Reveal & protect coverage gaps
Exposure Management
Identify & remediate at-risk data
Vulnerability Management
Pinpoint & eliminate risk
CyberGRC
Manage governance, risk & compliance
Next-Gen SIEM
Investigate with AI-driven detections
Threat Intelligence Platform
Recognize & mitigate adversaries
AI-Powered Security Operations
Automate & optimize workflows
Cloud-Native Application Protection
Discover & defend sensitive data
Application Security
Scan & simplify dev workflows
Explore the platform
Talk to an Expert
Product Tours
Customer Stories
All Products
MDR Services
Managed Detection and Response
Preemptive MDR that disrupts attackers
MDR for Microsoft
Maximize and protect your Microsoft investment
MDR for Enterprise
Get customized protection for enterprise systems
MDR ROI Calculator
See how MDR can boost your ROI
Rapid7 MDR vs. Competitors
Decide which solution fits
Exposure Management
Managed Vulnerability Management
Get help pinpointing exposures
Continuous Red Teaming
Get help validating exposures
Managed Application Security
Get help securing dev workflows
Penetration Testing Services
Get help with defense assessment
All services
MDR Buyer's Guide
Find the best MDR partner for your business
READ NOW
Intelligence
Rapid7 Intelligence tracks adversaries, shares proprietary, curated intelligence and research, and builds trusted open-source communities—all to help you improve your security program.
Explore Rapid7 Intelligence
Research and Intelligence
Latest Threat Research
Proprietary intelligence, research and adversary insights
Emergent Threat Response
Fast, expert analysis and security content for high-priority cyber threats
Tools and Services
Vulnerability & Exploit Database
Search thousands of CVEs
Metasploit
The world's most used penetration testing tool
Velociraptor
Endpoint monitoring, digital forensic and cyber response platform
Project Sonar
Improve security through the active analysis of public networks
Threat Intelligence Platform
Transform raw threat data into curated, high-fidelity intelligence
Global Threat Landscape Report
Find out what is driving the shift in 2026.
Read now
Learn
Blog
Webinars and Events
Resource Library
Cybersecurity Fundamentals
Product
Product Documentation
Product Release Notes
Product Extensions
Product Toolkits
Customer Support
Customer Support
Rapid7 Forum
Partner With Rapid7
Partnerships Overview
PACT Partner Program
Expand & enrich customer experience
PACT for Service Providers
Unlock SOC efficiencies
For Customers
Partner Directory
Find Resellers, MSSPs and Distributors
Technology Partners
Strengthen your security stack
AWS Partnership
Secure AWS resource types
Partner portal
Partner Login
Become a Partner
Develop & win business
Grow your business
Security where your customers need it
Become a partner
Company
About Us
Leadership Team
Our Customers
Careers
Contact Us
Media
Newsroom
Awards and Recognition
Investors
In the community
Social Good
Culture
Boston Bruins Partnership

Contact Get demo

Get Started

Take Action

Take a Product Tour

Get Breach Support

Contact Sales

Company

About Us

Leadership

Newsroom

Our Customers

Partner Programs

Investors

Careers

Stay Informed

Blog

Emergent Threat Response

Webinars & Events

Rapid7 Intelligence Research

Vulnerability Database

Security Fundamentals

For Customers

Support Portal

Product Documentation

Extension Library

Rapid7 Academy

Customer Escalation Portal

Contact Support

+1-866-390-8113

Legal Terms Privacy Policy Export Notice Trust Cookie List Accessibility Statement

Loading vulnerability database

BACK TO VEDB

CVE-2016-10149: Improper Restriction of XML External Entity Reference

Name: CVE-2016-10149: Improper Restriction of XML External Entity Reference
Creator: Rapid7
Published: 2017-03-24T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2016-10149, CWE-611, CVSS 7.5, EPSS 0.05024

REQUEST DEMO

XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.

CVSS Details

CVSS 3.0 Base Score: 7.5
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Debian	—	Upgrade python-pysaml2	Apr 3, 2017	Jan 12, 2017
Ubuntu	—	Upgrade python3-pysaml2Upgrade python-pysaml2	Aug 24, 2017	Mar 24, 2017

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

CVE details

CVSS v4 ScoreN/A

CVSS v3 Score

7.5 High

EPSS Score5%

EPSS Percentile92%

In CISA KEV CatalogueFalse

Published

Mar 24, 2017

References

NVD ↗

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business