Lucene search

[email protected]NVD:CVE-2014-0035

HistoryJul 07, 2014 - 2:55 p.m.

CVE-2014-0035

2014-07-0714:55:03

CWE-310

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.002

Percentile

59.4%

JSON

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

Affected configurations

Nvd

Node

apachecxfRange≤2.6.12

apachecxfMatch2.6.0

apachecxfMatch2.6.1

apachecxfMatch2.6.2

apachecxfMatch2.6.3

apachecxfMatch2.6.4

apachecxfMatch2.6.5

apachecxfMatch2.6.6

apachecxfMatch2.6.7

apachecxfMatch2.6.8

apachecxfMatch2.6.9

apachecxfMatch2.6.10

apachecxfMatch2.6.11

Node

apachecxfMatch2.7.0

apachecxfMatch2.7.1

apachecxfMatch2.7.2

apachecxfMatch2.7.3

apachecxfMatch2.7.4

apachecxfMatch2.7.5

apachecxfMatch2.7.6

apachecxfMatch2.7.7

apachecxfMatch2.7.8

apachecxfMatch2.7.9

Node

redhatjboss_enterprise_application_platformMatch6.0.0

redhatjboss_enterprise_application_platformMatch6.2.0

VendorProductVersionCPE
apachecxf*cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
apachecxf2.6.0cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:*
apachecxf2.6.1cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*
apachecxf2.6.2cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:*
apachecxf2.6.3cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:*
apachecxf2.6.4cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:*
apachecxf2.6.5cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:*
apachecxf2.6.6cpe:2.3:a:apache:cxf:2.6.6:*:*:*:*:*:*:*
apachecxf2.6.7cpe:2.3:a:apache:cxf:2.6.7:*:*:*:*:*:*:*
apachecxf2.6.8cpe:2.3:a:apache:cxf:2.6.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	cxf	*	cpe:2.3:a:apache:cxf::::::::
apache	cxf	2.6.0	cpe:2.3:a:apache:cxf:2.6.0:::::::*
apache	cxf	2.6.1	cpe:2.3:a:apache:cxf:2.6.1:::::::*
apache	cxf	2.6.2	cpe:2.3:a:apache:cxf:2.6.2:::::::*
apache	cxf	2.6.3	cpe:2.3:a:apache:cxf:2.6.3:::::::*
apache	cxf	2.6.4	cpe:2.3:a:apache:cxf:2.6.4:::::::*
apache	cxf	2.6.5	cpe:2.3:a:apache:cxf:2.6.5:::::::*
apache	cxf	2.6.6	cpe:2.3:a:apache:cxf:2.6.6:::::::*
apache	cxf	2.6.7	cpe:2.3:a:apache:cxf:2.6.7:::::::*
apache	cxf	2.6.8	cpe:2.3:a:apache:cxf:2.6.8:::::::*