CVE-2015-0277

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which…

published August 17, 2015

CVSS
—
EPSS
2%
Percentile
80.2
In the wild
Unconfirmed
What it is

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01960 · 80.2th percentile
Published
2015-08-17T20:00Z
EPSS history
Timeline
  • 17 AUG 20:00Z
    The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which…
    cvelistv5