GitHub Advisory DatabaseGHSA-99V3-9X35-C5VFImproper Authentication in Apache WSS4J
0.004 Low
EPSS
Percentile
73.3%
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.wss4j:wss4j-ws-security-dom | lt | 2.0.2 | |
| org.apache.ws.security:wss4j | lt | 1.6.17 |
References
rhn.redhat.com/errata/RHSA-2015-0236.html
rhn.redhat.com/errata/RHSA-2015-0675.html
rhn.redhat.com/errata/RHSA-2015-0850.html
rhn.redhat.com/errata/RHSA-2015-0851.html
seclists.org/oss-sec/2014/q4/437
exchange.xforce.ibmcloud.com/vulnerabilities/97754
github.com/advisories/GHSA-99v3-9x35-c5vf
issues.apache.org/jira/browse/WSS-511
lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2014-3623
Related
