PT-2014-3442

CVE-2014-0034

Publicado

2014-04-01

Atualizado

2022-05-13

Descrição por

CVSS 2.0

7.5

Alta

MétricasAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.6.12 Apache CXF versions 2.7.x prior to 2.7.9

Description The issue is related to the SecurityTokenService (STS) in Apache CXF, which does not properly validate SAML tokens when caching is enabled. This allows remote attackers to gain access via an invalid SAML token.

Recommendations For Apache CXF versions prior to 2.6.12, update to version 2.6.12 or later. For Apache CXF versions 2.7.x prior to 2.7.9, update to version 2.7.9 or later.

Explorabilidade

Correção

Impactos

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-264

CWE-20: Improper Input Validation

Identificadores relacionados

CVE-2014-0034

BDU:2022-03337

GHSA-38X2-FP9M-87MX