CVE-2011-4314

extension): MITM due to improper validation of AX attribute signatures

Published Jan 27, 2012 CVSS 2.0 · 5.8 Medium EPSS 3.1% KEV · Not listed
Description
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2011-4248 OpenID4Java does not verify that Attribute Exchange (AX) information is signed
Github GHSA Github GHSA GHSA-j473-c3rr-rx9p OpenID4Java does not verify that Attribute Exchange (AX) information is signed
History

No history.