Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
PicketLink 访问控制错误漏洞
Vulnerability Description
Red Hat Picketlink是美国红帽（Red Hat）公司的一个针对Java应用进行安全和身份认证管理的项目。 Red Hat PicketLink 2.7.0之前版本存在访问控制错误漏洞。攻击者利用该漏洞通过特制的SAML断言登录其他用户的帐户。
CVSS Information
N/A
Vulnerability Type
N/A