GitHub Advisoryadvisory · Maven

GHSA-3336-h95j-hvvf Improper Access Control in Apache CXF

MEDIUM Published 2022-05-13 Modified 2023-12-21 Official page ↗
Aliases
CVE-2015-5253
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-rs-security-sso-saml
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2022-07-06

Affected packages

• Maven org.apache.cxf:cxf-rt-rs-security-sso-saml: < 2.7.18 → fixed in 2.7.18 • Maven org.apache.cxf:cxf-rt-rs-security-sso-saml: >= 3.0.0, < 3.0.7 → fixed in 3.0.7 • Maven org.apache.cxf:cxf-rt-rs-security-sso-saml: >= 3.1.0, < 3.1.3 → fixed in 3.1.3

Description

The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."

Related

Alias · CVE (1)

  • CVE-2015-5253 The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References