Improper Authentication in Apache CXF
Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2012-2378US | medium4.3 | — | ||
Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the clien… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://cxf.apache.org/cve-2012-2378.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2012-1591.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2012-1592.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2012-1594.htmlWEB
- http://secunia.com/advisories/51607WEB
- http://svn.apache.org/viewvc?view=revision&revision=1337150WEB
- http://www.securityfocus.com/bid/53880WEB
- https://github.com/apache/cxfPACKAGE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan