Homepage

org.picketlink:picketlink-federation@2.5.4.SP7 vulnerabilities

  • latest version

    2.5.5.SP12

  • latest non vulnerable version

    2.7.1.Final

  • first published

    11 years ago

  • latest version published

    6 years ago

  • licenses detected

    • LGPL-3.0
      [2.5.0.Beta5,2.5.5.SP8); [2.6.0.Beta2,)

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.picketlink:picketlink-federation package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cryptographic Issues

    org.picketlink:picketlink-federation The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.

    [,2.7.0)
    • M
    Improper Access Control

    org.picketlink:picketlink-federation The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.

    [,2.7.0)
    Go back to all versions of this package