CVE-2011-4314

2012-01-2715:55:00

CWE-20

[email protected]

web.nvd.nist.gov

openid4java

jboss

step2

kay framework

vulnerability

mitm

cve-2011-4314

nvd

6.1 Medium

AI Score

Confidence

Low

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

0.005 Low

EPSS

Percentile

75.2%

JSON

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

CPENameOperatorVersion
openid:openid4javaopenid openid4javale0.9.5.593
kay_framework_project:kay_frameworkkay framework project kay frameworkeq1.0.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.1.2
openid:openid4javaopenid openid4javaeq0.9.2
kay_framework_project:kay_frameworkkay framework project kay frameworkeq0.1.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.1.1
kay_framework_project:kay_frameworkkay framework project kay frameworkle1.0.1
kay_framework_project:kay_frameworkkay framework project kay frameworkeq0.8.0
kay_framework_project:kay_frameworkkay framework project kay frameworkeq0.2.0
redhat:jboss_enterprise_application_platformredhat jboss enterprise application platformeq5.1.0

CPE	Name	Operator	Version
openid:openid4java	openid openid4java	le	0.9.5.593
kay_framework_project:kay_framework	kay framework project kay framework	eq	1.0.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.1.2
openid:openid4java	openid openid4java	eq	0.9.2
kay_framework_project:kay_framework	kay framework project kay framework	eq	0.1.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.1.1
kay_framework_project:kay_framework	kay framework project kay framework	le	1.0.1
kay_framework_project:kay_framework	kay framework project kay framework	eq	0.8.0
kay_framework_project:kay_framework	kay framework project kay framework	eq	0.2.0
redhat:jboss_enterprise_application_platform	redhat jboss enterprise application platform	eq	5.1.0