NVD

Id
25072  
Name
CVE-2015-3158  
Description
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2015-08-26  
Modified Date
2015-08-27  
Seq
2015-3158  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
132354 25072 CVE-2015-3158 RHSA-2015:1669  View
132355 25072 CVE-2015-3158 RHSA-2015:1670  View
132356 25072 CVE-2015-3158 RHSA-2015:1671  View
132357 25072 CVE-2015-3158 RHSA-2015:1672  View
132358 25072 CVE-2015-3158 RHSA-2015:1673  View
132359 25072 CVE-2015-3158 https://bugzilla.redhat.com/show_bug.cgi?id=1216123  View
132360 25072 CVE-2015-3158 https://github.com/picketlink/picketlink-bindings/pull/124  View
132361 25072 CVE-2015-3158 https://issues.jboss.org/browse/PLINK-708  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
9156 JVNDB-2015-004476 PicketLink の identity/federation/bindings/tomcat/idp/AbstractIDPValve.java における制限されたアプリケーションリソースへのアクセス権を取得される脆弱性 PicketLink の identity/federation/bindings/tomcat/idp/AbstractIDPValve.java の invokeNextValve 関数は、ロールベースの認証を適切にチェックしないため、制限されたアプリケーションリソースへのアクセス権を取得される脆弱性が存在します。 CVE-2015-3158 80383 CVE-2015-3158 25072 4 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-004476.html 2015-06-11 2015-08-28 View