PT-2015-6818 · Apache · Apache Cxf

Colm O Heigeartaigh · Published 2015-11-18 · Updated 2022-05-13 · CVE-2015-5253

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.7.18 Apache CXF versions 3.0.x prior to 3.0.7 Apache CXF versions 3.1.x prior to 3.1.3

Description The issue allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a wrapping attack.

Recommendations For Apache CXF versions prior to 2.7.18, update to version 2.7.18 or later. For Apache CXF versions 3.0.x prior to 3.0.7, update to version 3.0.7 or later. For Apache CXF versions 3.1.x prior to 3.1.3, update to version 3.1.3 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-264

Related Identifiers

CVE-2015-5253

GHSA-3336-H95J-HVVF

Affected Products

Apache Cxf

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2015-5253 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-0321.html · Vendor Advisory
• http://cxf.apache.org/security-advisories.data/CVE-2015-5253.txt.asc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3336-h95j-hvvf · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://github.com/apache/cxf/commit/845eccb6484b43ba02875c71e824db23ae4f20c0 · Note
• https://github.com/apache/cxf/commit/02245c656941f28b6b2be5e461e6db04a70d2436 · Note
• https://github.com/apache/cxf/commit/1c2a53080004d6ce275f2e70f46a0098d4140787 · Note
• https://git-wip-us.apache.org/repos/asf?p=cxf.git%3Ba=commitdiff%3Bh=845eccb6484b43ba02875c71e824db23ae4f20c0 · Note
• http://securitytracker.com/id/1034162 · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E · Note