Improper Access Control in Apache CXF
The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-5253US | medium4.0 | — | ||
The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML respon… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://cxf.apache.org/security-advisories.data/CVE-2015-5253.txt.ascWEB
- http://rhn.redhat.com/errata/RHSA-2016-0321.htmlWEB
- http://www.openwall.com/lists/oss-security/2015/11/14/1WEB
- https://git-wip-us.apache.org/repos/asf?p=cxf.git;a=commitdiff;h=845eccb6484b43ba02875c71e824db23ae4f20c0WEB
- https://github.com/apache/cxfWEB
- https://github.com/apache/cxf/commit/02245c656941f28b6b2be5e461e6db04a70d2436WEB
- https://github.com/apache/cxf/commit/1c2a53080004d6ce275f2e70f46a0098d4140787WEB
- https://github.com/apache/cxf/commit/845eccb6484b43ba02875c71e824db23ae4f20c0WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan