CVE-2015-3158: picketlink

CVSS: 4.0v2.0MediumModified

AliasesRHSA-2015:1669RHSA-2015:1670RHSA-2015:1671+2 more

Published 26-08-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-3158 is a medium (CVSS 4.0) vulnerability in picketlink. EPSS estimates a 1.91% chance of exploitation in the next 30 days, higher than 79.5% of scored vulnerabilities.

Overall risk

16/100

0100

Low · default modelHow is this calculated?

CVSS score

4.0/10

010

Medium · v2.0 (NVD)

EPSS score

1.91%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

26-08-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.

CVSS metrics

1 score · 1 source · 1 version

v2.04.0

EPSS trend

Probability

1.91%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

0.00 pp

From 1.91% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.91%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Redhat80 products

glassfish-jsf-eap6< 0:2.1.28-9.redhat_10.1.ep6.el5 | < 0:2.1.28-9.redhat_10.1.ep6.el6 | < 0:2.1.28-9.redhat_10.1.ep6.el7
hibernate4-core-eap6< 0:4.2.20-1.Final_redhat_1.1.ep6.el5 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el6 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el7
hibernate4-eap6< 0:4.2.20-1.Final_redhat_1.1.ep6.el5 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el6 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el7
hibernate4-entitymanager-eap6< 0:4.2.20-1.Final_redhat_1.1.ep6.el5 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el6 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el7
hibernate4-envers-eap6< 0:4.2.20-1.Final_redhat_1.1.ep6.el5 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el6 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el7

hibernate4-infinispan-eap6< 0:4.2.20-1.Final_redhat_1.1.ep6.el5 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el6 | < 0:4.2.20-1.Final_redhat_1.1.ep6.el7
hornetq< 0:2.3.25-4.SP3_redhat_1.1.ep6.el5 | < 0:2.3.25-4.SP3_redhat_1.1.ep6.el6 | < 0:2.3.25-4.SP3_redhat_1.1.ep6.el7
jboss-as-appclient< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-cli< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-client-all< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-clustering< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-cmp< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-configadmin< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-connector< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-console< 0:2.5.6-2.Final_redhat_2.1.ep6.el5 | < 0:2.5.6-2.Final_redhat_2.1.ep6.el6 | < 0:2.5.6-2.Final_redhat_2.1.ep6.el7
jboss-as-controller< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-controller-client< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-core-security< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-deployment-repository< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-deployment-scanner< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-domain-http< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-domain-management< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-ee< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-ee-deployment< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-ejb3< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-embedded< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-host-controller< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-jacorb< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-jaxr< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-jaxrs< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-jdr< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-jmx< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-jpa< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-jsf< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-jsr77< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-logging< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-mail< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-management-client-content< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-messaging< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-modcluster< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-naming< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-network< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-osgi< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-osgi-configadmin< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-osgi-service< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-picketlink< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-platform-mbean< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-pojo< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-process-controller< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-protocol< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-remoting< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-sar< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-security< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-server< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-system-jmx< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-threads< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-transactions< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-version< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-web< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-webservices< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-weld< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-as-xts< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jboss-ec2-eap< 0:7.5.3-1.Final_redhat_2.ep6.el6
jboss-ec2-eap-samples< 0:7.5.3-1.Final_redhat_2.ep6.el6
jboss-hal< 0:2.5.6-2.Final_redhat_2.1.ep6.el5 | < 0:2.5.6-2.Final_redhat_2.1.ep6.el6 | < 0:2.5.6-2.Final_redhat_2.1.ep6.el7
jboss-modules< 0:1.3.7-1.Final_redhat_1.1.ep6.el5 | < 0:1.3.7-1.Final_redhat_1.1.ep6.el6 | < 0:1.3.7-1.Final_redhat_1.1.ep6.el7
jbossas-appclient< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jbossas-bundles< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jbossas-core< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jbossas-domain< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jbossas-javadocs< 0:7.5.3-2.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-2.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-2.Final_redhat_2.1.ep6.el7
jbossas-modules-eap< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jbossas-product-eap< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jbossas-standalone< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jbossas-welcome-content-eap< 0:7.5.3-1.Final_redhat_2.1.ep6.el5 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el6 | < 0:7.5.3-1.Final_redhat_2.1.ep6.el7
jbossts< 1:4.17.30-1.Final_redhat_1.1.ep6.el5 | < 1:4.17.30-1.Final_redhat_1.1.ep6.el6 | < 1:4.17.30-1.Final_redhat_1.1.ep6.el7
jbossweb< 0:7.5.10-1.Final_redhat_1.1.ep6.el5 | < 0:7.5.10-1.Final_redhat_1.1.ep6.el6 | < 0:7.5.10-1.Final_redhat_1.1.ep6.el7
picketlink-bindings< 0:2.5.4-8.SP7_redhat_1.1.ep6.el5 | < 0:2.5.4-8.SP7_redhat_1.1.ep6.el6 | < 0:2.5.4-8.SP7_redhat_1.1.ep6.el7
picketlink-federation< 0:2.5.4-8.SP7_redhat_1.1.ep6.el5 | < 0:2.5.4-8.SP7_redhat_1.1.ep6.el6 | < 0:2.5.4-8.SP7_redhat_1.1.ep6.el7
resteasy< 0:2.3.12-1.Final_redhat_1.1.ep6.el5 | < 0:2.3.12-1.Final_redhat_1.1.ep6.el6 | < 0:2.3.12-1.Final_redhat_1.1.ep6.el7

Show all 80

Org.picketlink1 product

picketlink-tomcat-common< 2.7.1.Final

Picketlink1 product

picketlink≤ 2.7.0

3 vendors · 82 products

References

38 links

rhn.redhat.com/errata/RHSA-2015-1671.htmlVendor AdvisoryX Refsource REDHATWEB
rhn.redhat.com/errata/RHSA-2015-1672.htmlVendor AdvisoryX Refsource REDHATWEB
rhn.redhat.com/errata/RHSA-2015-1673.htmlVendor AdvisoryX Refsource REDHATWEB
rhn.redhat.com/errata/RHSA-2015-1670.htmlVendor AdvisoryX Refsource REDHATWEB
github.com/picketlink/picketlink-bindings/pull/124X Refsource CONFIRMWEB
issues.jboss.org/browse/PLINK-708X Refsource CONFIRMWEB
rhn.redhat.com/errata/RHSA-2015-1669.htmlVendor AdvisoryX Refsource REDHATWEB
bugzilla.redhat.com/show_bug.cgi?id=1216123X Refsource CONFIRMREPORTWEB
access.redhat.com/errata/RHSA-2015:1669Advisory
access.redhat.com/security/updates/classification/ARTICLE

Show all 38 references

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities