GitHub Advisoryadvisory · Maven

GHSA-9qhq-j4xm-cw48 PicketLink does not properly check role based authorization

MEDIUM Published 2022-05-17 Modified 2024-01-05 Official page ↗
Aliases
CVE-2015-3158
Ecosystem
Maven
Packages
org.picketlink:picketlink-tomcat-common
Severity
Moderate
Reviewed
2024-01-05

Affected packages

• Maven org.picketlink:picketlink-tomcat-common: < 2.7.1.Final → fixed in 2.7.1.Final

Description

The `invokeNextValve` function in `identity/federation/bindings/tomcat/idp/AbstractIDPValve.java` in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.

Related

Alias · CVE (1)

  • CVE-2015-3158 The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not… vulnerability

References