Improper Access Control in Apache WSS4J
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-0227US | medium5.0 | — | ||
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks." | ||||
02
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2015-0773.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0846.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0847.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0848.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0849.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-1176.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-1177.htmlWEB
- http://ws.apache.org/wss4j/advisories/CVE-2015-0227.txt.ascWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan