VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Oct 30, 2014· Updated May 6, 2026

CVE-2014-3623

CVE-2014-3623

Description

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.ws.security:wss4jMaven
< 1.6.171.6.17
org.apache.wss4j:wss4j-ws-security-domMaven
>= 2.0.0, < 2.0.22.0.2

Affected products

2
  • Apache/Cxf
    cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
    Range: >=2.7.0,<=2.7.13
  • Apache/Wss4j
    cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*
    Range: <1.6.17

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

23

News mentions

0

No linked articles in our index yet.