GHSA-9QHQ-J4XM-CW48 PicketLink does not properly check role based authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

PT-2015-6083

Name of the Vulnerable Software and Affected Versions PicketLink versions prior to 2.8.0.Beta1 PicketLink versions prior to 2.7.1.Final can be omitted as 2.8.0.Beta1 is a later version, so the correct output is: PicketLink versions prior to 2.8.0.Beta1 Description The invokeNextValve function in...