PT-2015-6818 · Apache · Apache Cxf

Colm O Heigeartaigh

·

Publicado

2015-11-18

·

Atualizado

2022-05-13

·

CVE-2015-5253

CVSS v2.0

4.0

Média

VetorAV:N/AC:L/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.7.18 Apache CXF versions 3.0.x prior to 3.0.7 Apache CXF versions 3.1.x prior to 3.1.3
Description The issue allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a wrapping attack.
Recommendations For Apache CXF versions prior to 2.7.18, update to version 2.7.18 or later. For Apache CXF versions 3.0.x prior to 3.0.7, update to version 3.0.7 or later. For Apache CXF versions 3.1.x prior to 3.1.3, update to version 3.1.3 or later.

Correção

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-284CWE-264

Identificadores relacionados

CVE-2015-5253
GHSA-3336-H95J-HVVF

Produtos afetados

Apache Cxf