CVE-2014-3623
Medium
Description
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
SeverityMedium
CVSS5.0
Exploit probability—
Product
Apache Wss4j
PublishedOct 30, 2014
First seenOct 30, 2014
How to fix
Update
- apache wss4j1.6.17, 2.0.2 or later
- apache cxf3.0.2 or later
- org.apache.ws.security:wss4j1.6.17 or later
- org.apache.wss4j:wss4j-ws-security-dom2.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache wss4j | v < 1.6.17, 2.0.0 ≤ v < 2.0.2 | 1.6.17, 2.0.2 |
| apache cxf | 2.7.0 ≤ v ≤ 2.7.13, 3.0.0 ≤ v < 3.0.2 | 3.0.2 |
| org.apache.ws.security:wss4jMaven | v < 1.6.17 | 1.6.17 |
| org.apache.wss4j:wss4j-ws-security-domMaven | 2.0.0 ≤ v < 2.0.2 | 2.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.