GoogleOSV:GHSA-88R4-38GC-97P4Apache Axis2 Vulnerable to XML Signature wrapping attack
7.2 High
AI Score
Confidence
Low
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.004 Low
EPSS
Percentile
71.9%
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an “XML Signature wrapping attack.”
References
www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf
www.openwall.com/lists/oss-security/2012/09/12/1
www.openwall.com/lists/oss-security/2012/09/13/1
bugzilla.redhat.com/show_bug.cgi?id=856755
github.com/apache/axis-axis2-java-core
issues.apache.org/jira/browse/AXIS2-5930
issues.apache.org/jira/browse/AXIS2C-1694
nvd.nist.gov/vuln/detail/CVE-2012-4418
web.archive.org/web/20121114075457/www.securityfocus.com/bid/55508
Related
7.2 High
AI Score
Confidence
Low
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.004 Low
EPSS
Percentile
71.9%