CVE-2015-6254

MITTEL 6.0CVE-2015-6254 · Published 17/08/2015 · updated 17/06/2026

Kurz gesagt

CVE-2015-6254 ist eine Schwachstelle (MITTEL (CVSS 6.0)) in picketlink (picketlink).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.8%, höher als bei 78.4% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
picketlink picketlink	`≤ 2.6.0`	No fix yet

Description

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.

References

Weitere Schwachstellen in picketlink

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free