PT-2015-4532

CVE-2015-0227

Published

2015-02-12

Updated

2022-05-14

Description by

CVSS 2.0

5.0

Medium

MetricsAV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache WSS4J versions 1.6.16 and earlier, 2.x versions prior to 2.0.2

Description The issue allows remote attackers to bypass the requireSignedEncryptedDataElements configuration through vectors related to "wrapping attacks". This enables attackers to evade security measures.

Recommendations For Apache WSS4J versions 1.6.16 and earlier, update to version 1.6.17 or later. For Apache WSS4J 2.x versions prior to 2.0.2, update to version 2.0.2 or later.

Exploitability

Fix

Impacts

Researchers

Christian Mainka

Dennis Kupser

Juraj Somorovsky

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

CWE-264