Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2015-0277 Details

Description

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://rhn.redhat.com/errata/RHSA-2015-0846.html CVE
http://rhn.redhat.com/errata/RHSA-2015-0847.html CVE
http://rhn.redhat.com/errata/RHSA-2015-0848.html CVE
http://rhn.redhat.com/errata/RHSA-2015-0849.html CVE
https://bugzilla.redhat.com/show_bug.cgi?id=1194832 CVE

see all 12 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-284Improper Access Control[email protected]

Affected Products

ProductVersions
picketlink picketlink
<= 2.6.0

CPE

  • cpe:2.3:a:picketlink:picketlink:*:cr5:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

9 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2015-0277
NVD Published Date:
Aug 17, 2015
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]