GitHub Advisoryadvisory · Maven

GHSA-j473-c3rr-rx9p OpenID4Java does not verify that Attribute Exchange (AX) information is signed

MEDIUM Published 2022-05-17 Modified 2025-04-12 Official page ↗
Aliases
CVE-2011-4314
Ecosystem
Maven
Packages
org.openid4java:openid4java
Severity
Moderate
Weaknesses
CWE-20, CWE-345
Reviewed
2025-04-12

Affected packages

• Maven org.openid4java:openid4java: < 0.9.6 → fixed in 0.9.6

Description

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

Related

Alias · CVE (1)

  • CVE-2011-4314 message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-345 Insufficient Verification of Data Authenticity weakness

References