Skip to content

Improper Authentication in Apache WSS4J

Moderate severity GitHub Reviewed Published May 13, 2022 to the GitHub Advisory Database • Updated Feb 2, 2023

Package

maven org.apache.ws.security:wss4j (Maven)

Affected versions

< 1.6.17

Patched versions

1.6.17
maven org.apache.wss4j:wss4j-ws-security-dom (Maven)
>= 2.0.0, < 2.0.2
2.0.2

Description

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.

References

Published by the National Vulnerability Database Oct 30, 2014
Published to the GitHub Advisory Database May 13, 2022
Reviewed Jul 7, 2022
Last updated Feb 2, 2023

Severity

Moderate

EPSS score

0.839%
(82nd percentile)

Weaknesses

CVE ID

CVE-2014-3623

GHSA ID

GHSA-99v3-9x35-c5vf

Source code

No known source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.