The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2015-08-17T20:00:00

Updated: 2024-08-06T07:15:13.276Z

Reserved: 2015-08-17T00:00:00

Link: CVE-2015-6254

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2015-08-17T20:59:01.763

Modified: 2015-08-19T22:54:03.783

Link: CVE-2015-6254

cve-icon Redhat

Severity : Important

Publid Date: 2015-04-14T00:00:00Z

Links: CVE-2015-6254 - Bugzilla