CVEvulnerability

CVE-2011-4314

5.8 MEDIUM Published 2012-01-27 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-01-27
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:P
Weaknesses
CWE-20

Description

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

Affected configurations

• kay framework project kay framework (<= 1.0.1) • kay framework project kay framework 0.0.0 • kay framework project kay framework 0.1.0 • kay framework project kay framework 0.2.0 • kay framework project kay framework 0.3.0 • kay framework project kay framework 0.8.0 • kay framework project kay framework 1.0.0 • openid openid4java (<= 0.9.5.593) • openid openid4java 0.9.2 • openid openid4java 0.9.3 • openid openid4java 0.9.4.339 • redhat jboss enterprise application platform 5.1.0 • redhat jboss enterprise application platform 5.1.1 • redhat jboss enterprise application platform 5.1.2

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References