CVE-2015-5253

Apache CXF <2.7.18, <3.0.7, <3.1.3 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2015-5253. PoCs published by dawetmaster, andikahilmy.

AI-analyzed exploit summary The repository contains benchmark and performance testing code for Apache CXF but lacks any exploit code or technical details related to CVE-2015-5253. The README is a generic Apache CXF introduction without vulnerability-specific content.

Description

The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."

Exploits (2)

nomisec STUB
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2015-5253-cxf-vulnerable

The repository contains benchmark and performance testing code for Apache CXF but lacks any exploit code or technical details related to CVE-2015-5253. The README is a generic Apache CXF introduction without vulnerability-specific content.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Apache CXF
No auth needed
Prerequisites: none
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec STUB
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2015-5253-cxf-vulnerable

The repository contains benchmark and performance testing code for Apache CXF but lacks any exploit code or technical details related to CVE-2015-5253. The README is a generic Apache CXF introduction without vulnerability-specific content.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Apache CXF
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (11)

Core 11
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034162
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0321.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/11/14/1

Scores

EPSS 0.0034
EPSS Percentile 57.0%

Details

CWE
CWE-264
Status published
Products (2)
apache/cxf < 2.7.18
org.apache.cxf/cxf-rt-rs-security-sso-saml 0 - 2.7.18Maven
Published Nov 18, 2015
Tracked Since Feb 18, 2026