GitHub Advisoryadvisory · Maven

GHSA-66rx-gqx3-p98m Improper Authentication in Apache Axis2

MEDIUM Published 2022-05-13 Modified 2022-07-13 Official page ↗
Aliases
CVE-2012-5351
Ecosystem
Maven
Packages
org.apache.axis2:axis2
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2022-07-13

Affected packages

• Maven org.apache.axis2:axis2: < 1.6.4 → fixed in 1.6.4

Description

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.

Related

Alias · CVE (1)

  • CVE-2012-5351 Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References