[MAVEN:GHSA-V45R-RJ5X-HPG2] Cleartext Transmission of Sensitive Information in Apache CXF
Severity
Moderate
Affected Packages
2
Fixed Packages
2
CVEs
1
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
| Package | Affected Version |
|---|---|
 pkg:maven/org.apache.cxf/cxf-core
|
>= 2.7.0, < 2.7.10 |
|
pkg:maven/org.apache.cxf/cxf-core
|
< 2.6.13 |
| Package | Fixed Version |
|---|---|
|
pkg:maven/org.apache.cxf/cxf-core
|
= 2.7.10 |
|
pkg:maven/org.apache.cxf/cxf-core
|
= 2.6.13 |
- ID
- MAVEN:GHSA-V45R-RJ5X-HPG2
- Severity
- moderate
- URL
- https://github.com/advisories/GHSA-v45r-rj5x-hpg2
- Published
-
2022-05-13T01:09:20
(2 years ago) - Modified
-
2023-12-21T21:22:55
(9 months ago) - Rights
- Maven Security Team
| Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
|---|---|---|---|---|---|---|---|
| Affected | pkg:maven/org.apache.cxf/cxf-core | org.apache.cxf |
cxf-core
|
>= 2.7.0 < 2.7.10 | |||
| Fixed | pkg:maven/org.apache.cxf/cxf-core | org.apache.cxf |
cxf-core
|
= 2.7.10 | |||
| Affected | pkg:maven/org.apache.cxf/cxf-core | org.apache.cxf |
cxf-core
|
< 2.6.13 | |||
| Fixed | pkg:maven/org.apache.cxf/cxf-core | org.apache.cxf |
cxf-core
|
= 2.6.13 |
| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
|---|---|---|---|---|---|---|---|---|---|---|---|
| # CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |