CVE-2014-3623

EUVD-2022-3343
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 85%
Affected Products (NVD)
VendorProductVersion
apachewss4j
𝑥
< 1.6.17
apachewss4j
2.0.0 ≤
𝑥
< 2.0.2
apachecxf
2.7.0 ≤
𝑥
≤ 2.7.13
apachecxf
3.0.0 ≤
𝑥
< 3.0.2
𝑥
= Vulnerable software versions
References