GitHub Advisoryadvisory · Maven

GHSA-38x2-fp9m-87mx Improper Input Validation in Apache CXF

MEDIUM Published 2022-05-13 Modified 2023-12-21 Official page ↗
Aliases
CVE-2014-0034
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-ws-security
Severity
Moderate
Weaknesses
CWE-20
Reviewed
2022-07-07

Affected packages

• Maven org.apache.cxf:cxf-rt-ws-security: < 2.6.12 → fixed in 2.6.12 • Maven org.apache.cxf:cxf-rt-ws-security: >= 2.7.0, < 2.7.9 → fixed in 2.7.9

Description

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

Related

Alias · CVE (1)

  • CVE-2014-0034 The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References