Описание
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.
A flaw was found in the PicketLink Identity Provider Configuration (IDP) where, under specific conditions, the IDP ignores role-based authorization. This could lead to an authenticated user being able to access application resources that are not permitted for a given role.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | picketlink | Affected | ||
| Red Hat JBoss BRMS 6 | picketlink | Affected | ||
| Red Hat JBoss Data Grid 6 | picketlink | Affected | ||
| Red Hat JBoss Data Virtualization 6 | picketlink | Affected | ||
| Red Hat JBoss Enterprise Application Platform 5 | picketlink | Will not fix | ||
| Red Hat JBoss Fuse Service Works 6 | picketlink | Affected | ||
| Red Hat JBoss Operations Network 3 | picketlink | Affected | ||
| Red Hat JBoss Portal 6 | picketlink | Affected | ||
| Red Hat JBoss SOA Platform 5 | picketlink | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 6.4 | picketlink | Fixed | RHSA-2015:1672 | 24.08.2015 |
Показывать по
Дополнительная информация
Статус:
EPSS
3.5 Low
CVSS2
Связанные уязвимости
The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.
PicketLink does not properly check role based authorization
EPSS
3.5 Low
CVSS2