Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
BID:70736
Info
Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
| Bugtraq ID: | 70736 |
| Class: | Design Error |
| CVE: |
CVE-2014-3623 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 24 2014 12:00AM |
| Updated: | May 07 2015 06:18PM |
| Credit: | Dario Amiri (GE Global Research) |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
Apache CXF is prone to a security-bypass vulnerability.
An attacker can exploit this issue to bypass certain security restrictions and perform spoofing attacks; this may aid in launching further attacks.
The following versions are affected:
Apache CXF 2.7.x prior to 2.7.13
Apache CXF 3.0.x prior to 3.0.2
Apache CXF is prone to a security-bypass vulnerability.
An attacker can exploit this issue to bypass certain security restrictions and perform spoofing attacks; this may aid in launching further attacks.
The following versions are affected:
Apache CXF 2.7.x prior to 2.7.13
Apache CXF 3.0.x prior to 3.0.2
Exploit / POC
Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.