GitHub Advisoryadvisory · Maven

GHSA-6r5v-hp32-fjqw Improper Access Control in Apache WSS4J

MEDIUM Published 2022-05-14 Modified 2026-04-17 Official page ↗
Aliases
CVE-2015-0227
Ecosystem
Maven
Packages
org.apache.ws.security:wss4j, wss4j:wss4j
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2022-07-06

Affected packages

• Maven org.apache.ws.security:wss4j: < 1.6.17 → fixed in 1.6.17 • Maven org.apache.ws.security:wss4j: >= 2.0.0, < 2.02 → fixed in 2.02 • Maven wss4j:wss4j: < 1.6.17 → fixed in 1.6.17

Description

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

Related

Alias · CVE (1)

  • CVE-2015-0227 Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References