CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-5656 – cxf: CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens
https://notcve.org/view.php?id=CVE-2017-5656
Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user. Apache CXF's STSClient en versiones anteriores a 3.1.11 y 3.0.13 utiliza un modo defectuoso de los tokens de caché que están asociados al los tokens de delegación, lo que significa que el atacante puede modificar el token el cual puede devolver el identificador correspondiente al token de cacheo a otro usuario. It was found that the token cacher in Apache cxf uses a flawed way of caching tokens that are associated with the delegation token received from Security Token Service (STS). This vulnerability could allow an attacker to craft a token which could return an identifier corresponding to a cached token for another user. • http://cxf.apache.org/security-advisories.data/CVE-2017-5656.txt.asc?version=1&modificationDate=1492515113282&api=v2 http://www.securityfocus.com/bid/97971 http://www.securitytracker.com/id/1038282 https://access.redhat.com/errata/RHSA-2017:1832 https://access.redhat.com/errata/RHSA-2018:1694 https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache&# • CWE-384: Session Fixation •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2016-6812 – apache-cxf: XSS in Apache CXF FormattedServiceListWriter
https://notcve.org/view.php?id=CVE-2016-6812
The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client. El módulo de transporte HTTP en Apache CXF anterior a su versión 3.0.12 y en versiones 3.1.x anteriores a 3.1.9 utiliza FormattedServiceListWriter para proporcionar una página HTML que enumera los nombres y URL absolutas de endpoints de servicio disponibles. • http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc http://www.securityfocus.com/bid/97582 http://www.securitytracker.com/id/1037543 https://access.redhat.com/errata/RHSA-2017:0868 https://issues.apache.org/jira/browse/CXF-6216 https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/th • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2016-8739 – apache-cxf: Atom entity provider of Apache CXF JAX-RS is vulnerable to XXE
https://notcve.org/view.php?id=CVE-2016-8739
The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk. El módulo JAX-RS en Apache CXF anterior a 3.0.12 y en sus versiones 3.1.x anteriores a 3.1.9 proporciona un número de Atom JAX-RS MessageBodyReaders. Estos lectores emplean Apache Abdera Parser que expande las entidades XML por defecto. Esto representa un gran riesgo de XXE. • http://cxf.apache.org/security-advisories.data/CVE-2016-8739.txt.asc http://www.securityfocus.com/bid/97579 http://www.securitytracker.com/id/1037544 https://access.redhat.com/errata/RHSA-2017:0868 https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Cco • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5253 – apache-cxf: SAML SSO processing is vulnerable to wrapping attack
https://notcve.org/view.php?id=CVE-2015-5253
The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack." El módulo Web SSO SAML en Apache CXF en versiones anteriores a 2.7.18, 3.0.x en versiones anteriores a 3.0.7 y 3.1.x en versiones anteriores a 3.1.3 permite a usuarios remotos autenticados eludir la autenticación a través de una respuesta SAML manipulada con una aserción firmada valida, relacionado con un 'wrapping attack.' It was found that Apache CXF permitted wrapping attacks in its support for SAML SSO. A malicious user could construct a SAML response that would bypass the login screen and possibly gain access to restricted information or resources. • http://cxf.apache.org/security-advisories.data/CVE-2015-5253.txt.asc http://rhn.redhat.com/errata/RHSA-2016-0321.html http://www.openwall.com/lists/oss-security/2015/11/14/1 http://www.securitytracker.com/id/1034162 https://git-wip-us.apache.org/repos/asf?p=cxf.git%3Ba=commitdiff%3Bh=845eccb6484b43ba02875c71e824db23ae4f20c0 https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2014-3623 – CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods
https://notcve.org/view.php?id=CVE-2014-3623
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors. Apache WSS4J anterior a versión 1.6.17 y versiones 2.x anteriores a 2.0.2, tal y como es usado en Apache CXF versiones 2.7.x anteriores a 2.7.13 y versiones 3.0.x anteriores a 3.0.2, cuando se usa TransportBinding, no se impone apropiadamente la semántica de seguridad del método SubjectConfirmation de SAML, que permite a los atacantes remotos conducir ataques de suplantación de identidad por medio de vectores no especificados. It was found that Apache WSS4J (Web Services Security for Java), as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of spoofing attacks on web service endpoints secured by WSS4J that rely on SAML for authentication. • http://rhn.redhat.com/errata/RHSA-2015-0236.html http://rhn.redhat.com/errata/RHSA-2015-0675.html http://rhn.redhat.com/errata/RHSA-2015-0850.html http://rhn.redhat.com/errata/RHSA-2015-0851.html http://seclists.org/oss-sec/2014/q4/437 http://secunia.com/advisories/61909 http://www.securityfocus.com/bid/70736 https://exchange.xforce.ibmcloud.com/vulnerabilities/97754 https://issues.apache.org/jira/browse/WSS-511 https://lists.apache.org/thread.html/r36e44ffc1a9b365327d • CWE-287: Improper Authentication CWE-347: Improper Verification of Cryptographic Signature •