CVE-2015-6254

PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion

Published Aug 17, 2015 CVSS 3.1 · 6.3 Medium EPSS 1.8% KEV · Not listed
Description
The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2015-6196 The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 6, 2024, 7:15 AM
Reserved
Aug 17, 2015, 12:00 AM
Status
Modified
Published
Aug 17, 2015, 8:59 PM
Modified
Jun 17, 2026, 12:30 AM
Severity
Important
Public date
Apr 14, 2015, 12:00 AM