5

CVE-2014-3623

EPSS 2.49%
Veröffentlicht 30.10.2014 14:55:07
Zuletzt bearbeitet 06.05.2026 22:30:45
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 18

NVD 4 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Wss4j Version < 1.6.17

Apache ≫ Wss4j Version >= 2.0.0 < 2.0.2

Apache ≫ Cxf Version >= 2.7.0 <= 2.7.13

Apache ≫ Cxf Version >= 3.0.0 < 3.0.2

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.49%	0.848

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

http://rhn.redhat.com/errata/RHSA-2015-0675.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0850.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0851.html

Third Party Advisory

http://seclists.org/oss-sec/2014/q4/437

Third Party Advisory

Mailing List

http://secunia.com/advisories/61909

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0236.html

Third Party Advisory

http://www.securityfocus.com/bid/70736

Third Party Advisory

VDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/97754

VDB Entry

https://issues.apache.org/jira/browse/WSS-511

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2014-3623

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-3623

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-3623

EUVD