Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2014-0035GHSA-V45R-RJ5X-HPG2

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 2.6.13, 2.7.10
None on Exploit-DB, Metasploit or GitHub

Summary

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • n/a n/a

    Version range not reported

  • org.apache.cxf:cxf-coreMaven

    fixed in 2.6.13

  • org.apache.cxf:cxf-coreMaven

    From 2.7.0 · fixed in 2.7.10

References 14

rhn.redhat.com

cxf.apache.org

svn.apache.org

lists.apache.org