NetSight
IP …
medium5.0

CVE-2014-3623

Improper Authentication in Apache WSS4J

Impact

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.ws.security:wss4j< 1.6.171.6.17
mavenorg.apache.wss4j:wss4j-ws-security-dom>= 2.0.0, < 2.0.22.0.2

Affected products

VendorProductAffected versions
ApacheWss4j
before 1.6.17
from 2.0.0 before 2.0.2
ApacheCxf
from 2.7.0 through 2.7.13
from 3.0.0 before 3.0.2

Weakness classification

CWE-287

References