PT-2014-3442 · Apache · Apache Cxf

Published 2014-04-01 · Updated 2022-05-13 · CVE-2014-0034

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.6.12 Apache CXF versions 2.7.x prior to 2.7.9

Description The issue is related to the SecurityTokenService (STS) in Apache CXF, which does not properly validate SAML tokens when caching is enabled. This allows remote attackers to gain access via an invalid SAML token.

Recommendations For Apache CXF versions prior to 2.6.12, update to version 2.6.12 or later. For Apache CXF versions 2.7.x prior to 2.7.9, update to version 2.7.9 or later.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

BDU:2022-03337

CVE-2014-0034

GHSA-38X2-FP9M-87MX

RHSA-2014:0798

RHSA-2014:0799

Affected Products

Apache Cxf

References · 31

• http://rhn.redhat.com/errata/RHSA-2015-0850.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0799.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0851.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1351.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0034 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0797.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0798.html · Vendor Advisory
• http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.asc · Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=1551228 · Patch
• https://osv.dev/vulnerability/GHSA-38x2-fp9m-87mx · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03337 · Security Note
• https://github.com/apache/cxf · Note
• https://github.com/apache/cxf/commit/b4b9a010bb23059251400455afabddee15b46127 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0034 · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Note