VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 26, 2015· Updated May 6, 2026

CVE-2015-3158

CVE-2015-3158

Description

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.picketlink:picketlink-tomcat-commonMaven
< 2.7.1.Final2.7.1.Final

Affected products

1

Patches

1
ae6ff4adfc56

Merge pull request #124 from pedroigor/master

https://github.com/picketlink/picketlink-bindingsPedro IgorJun 11, 2015via ghsa
commit
1 file changed · +4 −0
  • picketlink-tomcat-common/src/main/java/org/picketlink/identity/federation/bindings/tomcat/idp/AbstractIDPValve.java+4 −0 modified
    @@ -400,6 +400,10 @@ public void invoke(Request request, Response response) throws IOException, Servl
 
         invokeNextValve(request, response);
 
+        if (isUnauthorized(response)) {
+            return;
+        }
+
         userPrincipal = request.getUserPrincipal();
 
         // we only handle SAML messages for authenticated users.

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.