Improper Input Validation in Apache CXF
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-0034US | medium4.3OT elevated | — | ||
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to g… | ||||
02
references
External citations — patches, advisories, analysis.
- http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.ascWEB
- http://rhn.redhat.com/errata/RHSA-2014-0797.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-0798.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-0799.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-1351.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0850.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0851.htmlWEB
- http://svn.apache.org/viewvc?view=revision&revision=1551228WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan