PicketLink does not properly check role based authorization

MEDIUM 4.0CVE-2015-3158 · GHSA-9qhq-j4xm-cw48 · Published 26/08/2015 · updated 17/06/2026

In short

CVE-2015-3158 is a MEDIUM (CVSS 4.0) vulnerability affecting org.picketlink:picketlink-tomcat-common, picketlink (picketlink).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.9% of all vulnerabilities.
Fix: update to 2.7.1.Final or later.

Package	Affected versions	Patched versions
org.picketlink:picketlink-tomcat-common Maven	`< 2.7.1.Final`	`2.7.1.Final`
picketlink picketlink	`≤ 2.7.0`	No fix yet

Description

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.

NVD description

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.

References

nvd.nist.gov/vuln/detail/CVE-2015-3158 · ADVISORY
picketlink/picketlink-bindings#124 · WEB
picketlink/picketlink-bindings commit ae6ff4a · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
picketlink/picketlink-bindings · PACKAGE
issues.jboss.org/browse/PLINK-708 · WEB
rhn.redhat.com/errata/RHSA-2015-1669.html · WEB
rhn.redhat.com/errata/RHSA-2015-1670.html · WEB
rhn.redhat.com/errata/RHSA-2015-1671.html · WEB
rhn.redhat.com/errata/RHSA-2015-1672.html · WEB
rhn.redhat.com/errata/RHSA-2015-1673.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free