NVD

Id
22760  
Name
CVE-2015-0277  
Description
The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users" accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-08-17  
Modified Date
2015-08-19  
Seq
2015-0277  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
120614 22760 CVE-2015-0277 RHSA-2015:0846  View
120615 22760 CVE-2015-0277 RHSA-2015:0847  View
120616 22760 CVE-2015-0277 RHSA-2015:0848  View
120617 22760 CVE-2015-0277 RHSA-2015:0849  View
120618 22760 CVE-2015-0277 https://bugzilla.redhat.com/show_bug.cgi?id=1194832  View
120619 22760 CVE-2015-0277 https://issues.jboss.org/browse/PLINK-678  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
8981 JVNDB-2015-004301 PicketLink の Service Provider における他のユーザアカウントにログインされる脆弱性 PicketLink の Service Provider (SP) は、AudienceRestriction が指定されている場合、Audience 要素のメンバーかどうかを確認しないため、他のユーザアカウントにログインされる脆弱性が存在します。 CVE-2015-0277 77488 CVE-2015-0277 22760 6 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-004301.html 2015-02-27 2015-08-24 View