Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBindi

Summary

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.

Timeline

1. Oct 30, 2014, 2:00 PM UTCCVE published
2. Aug 6, 2024, 10:50 AM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• org.apache.ws.security:wss4jMaven

  fixed in 1.6.17

• org.apache.wss4j:wss4j-ws-security-domMaven

  From 2.0.0 · fixed in 2.0.2

References 15