GitHub Advisoryadvisory · Maven

GHSA-99v3-9x35-c5vf Improper Authentication in Apache WSS4J

MEDIUM Published 2022-05-13 Modified 2022-07-07 Official page ↗
Aliases
CVE-2014-3623
Ecosystem
Maven
Packages
org.apache.ws.security:wss4j, org.apache.wss4j:wss4j-ws-security-dom
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2022-07-07

Affected packages

• Maven org.apache.ws.security:wss4j: < 1.6.17 → fixed in 1.6.17 • Maven org.apache.wss4j:wss4j-ws-security-dom: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2014-3623 Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References