GHSA-9qhq-j4xm-cw48Medium

PicketLink does not properly check role based authorization

Published
May 17, 2022
Last Modified
January 5, 2024

🔗 CVE IDs covered (1)

CVE-2015-3158 →

📋 Description

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.

🎯 Affected products1

  • maven/org.picketlink:picketlink-tomcat-common:< 2.7.1.Final

🔗 References (11)