CVE-2015-0277

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.

• CWE-284

• http://rhn.redhat.com/errata/RHSA-2015-0846.html
• http://rhn.redhat.com/errata/RHSA-2015-0847.html
• http://rhn.redhat.com/errata/RHSA-2015-0848.html
• http://rhn.redhat.com/errata/RHSA-2015-0849.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1194832
• https://issues.jboss.org/browse/PLINK-678
• http://rhn.redhat.com/errata/RHSA-2015-0846.html
• http://rhn.redhat.com/errata/RHSA-2015-0847.html
• http://rhn.redhat.com/errata/RHSA-2015-0848.html
• http://rhn.redhat.com/errata/RHSA-2015-0849.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1194832
• https://issues.jboss.org/browse/PLINK-678

Published

Aug 17, 2015

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-0271The log-viewing function in the Red Hat redhat-access-plugin…
• CVE-2015-0272GNOME NetworkManager allows remote attackers to cause a deni…
• CVE-2015-0273Multiple use-after-free vulnerabilities in ext/date/php_date…
• CVE-2015-0274The XFS implementation in the Linux kernel before 3.15 impro…
• CVE-2015-0275The ext4_zero_range function in fs/ext4/extents.c in the Lin…
• CVE-2015-0276Cross-site request forgery (CSRF) vulnerability in Kallithea…
• CVE-2015-0278libuv before 0.10.34 does not properly drop group privileges…
• CVE-2015-0279JBoss RichFaces before 4.5.4 allows remote attackers to inje…
• CVE-2015-0280Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-0281Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-0282GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 sig…
• CVE-2015-0283The slapi-nis plug-in before 0.54.2 does not properly reallo…