CVE-2014-3623

Apache Wss4j < 1.6.17 - Authentication Bypass

Title source: rule

Description

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.

References (15)

Scores

EPSS 0.0249
EPSS Percentile 85.1%

Classification

CWE
CWE-287
Status draft

Affected Products (4)

apache/wss4j < 1.6.17
apache/cxf < 2.7.13
org.apache.ws.security/wss4j < 1.6.17Maven
org.apache.wss4j/wss4j-ws-security-dom < 2.0.2Maven

Timeline

Published Oct 30, 2014
Tracked Since Feb 18, 2026