Cleartext Transmission of Sensitive Information in Apache CXF
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-0035US | medium4.3OT elevated | — | ||
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, t… | ||||
02
references
External citations — patches, advisories, analysis.
- http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.ascWEB
- http://rhn.redhat.com/errata/RHSA-2014-0797.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-0798.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-0799.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-1351.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0850.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0851.htmlWEB
- http://svn.apache.org/viewvc?view=revision&revision=1564724WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan