PT-2015-4532

CVE-2015-0227

Publicado

2015-02-12

Atualizado

2022-05-14

Descrição por

CVSS 2.0

5.0

Média

MétricasAV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache WSS4J versions 1.6.16 and earlier, 2.x versions prior to 2.0.2

Description The issue allows remote attackers to bypass the requireSignedEncryptedDataElements configuration through vectors related to "wrapping attacks". This enables attackers to evade security measures.

Recommendations For Apache WSS4J versions 1.6.16 and earlier, update to version 1.6.17 or later. For Apache WSS4J 2.x versions prior to 2.0.2, update to version 2.0.2 or later.

Explorabilidade

Correção

Impactos

Pesquisadores

Christian Mainka

Dennis Kupser

Juraj Somorovsky

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-284: Improper Access Control

CWE-264