1. Home
  2. Vulnerabilities
  3. CVE-2015-0227

CVE-2015-0227

CVSS v2.0 5 (Medium)
50% Progress
EPSS 0.17 % (54th)
0.17% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS Affected Configurations References Security Advisories Packages & Software OVAL Tools, Exploits & PoC Graph Web & Social Timeline

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

Weaknesses
CWE-264
Permissions, Privileges, and Access Controls
CVE Status
PUBLISHED
CNA
Red Hat, Inc.
Published Date
2015-02-12 16:59:02
(9 years ago)
Updated Date
2018-10-04 10:29:01
(6 years ago)

Affected Products

Apache

Configuration #1

    CPE23 From Up To
  Apache Wss4j 1.6.16 and prior versions cpe:2.3:a:apache:wss4j <= 1.6.16
  Apache Wss4j 2.0.0 cpe:2.3:a:apache:wss4j:2.0.0
  Apache Wss4j 2.0.0 Rc1 cpe:2.3:a:apache:wss4j:2.0.0:rc1
  Apache Wss4j 2.0.1 cpe:2.3:a:apache:wss4j:2.0.1