CoreCVE
Back

MEDIUM

PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion

Published Aug 17, 2015

Description

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (2)

CWE-17

CWE-345

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Aug 17, 2015
Updated Aug 6, 2024
Reserved Aug 17, 2015
Link CVE-2015-6254
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2015-6254
Red Hat
Severity Important
Public date Apr 14, 2015
Links CVE-2015-6254 - Bugzilla