PT-2014-3443 · Apache · Apache Cxf

Publicado

2014-07-07

·

Atualizado

2022-05-13

·

CVE-2014-0035

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.6.13 Apache CXF versions 2.7.x prior to 2.7.10
Description The issue allows remote attackers to obtain sensitive information by sniffing the network, due to the transmission of the UsernameToken in cleartext when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken.
Recommendations For Apache CXF versions prior to 2.6.13, update to version 2.6.13 or later. For Apache CXF versions 2.7.x prior to 2.7.10, update to version 2.7.10 or later.

Correção

Cleartext Transmission of Sensitive Information

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-319CWE-310

Identificadores relacionados

CVE-2014-0035
GHSA-V45R-RJ5X-HPG2
RHSA-2014:0798
RHSA-2014:0799

Produtos afetados

Apache Cxf