PT-2014-3442 · Apache · Apache Cxf

Publicado

2014-04-01

·

Atualizado

2022-05-13

·

CVE-2014-0034

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.6.12 Apache CXF versions 2.7.x prior to 2.7.9
Description The issue is related to the SecurityTokenService (STS) in Apache CXF, which does not properly validate SAML tokens when caching is enabled. This allows remote attackers to gain access via an invalid SAML token.
Recommendations For Apache CXF versions prior to 2.6.12, update to version 2.6.12 or later. For Apache CXF versions 2.7.x prior to 2.7.9, update to version 2.7.9 or later.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20CWE-264

Identificadores relacionados

BDU:2022-03337
CVE-2014-0034
GHSA-38X2-FP9M-87MX
RHSA-2014:0798
RHSA-2014:0799

Produtos afetados

Apache Cxf