CVE-2012-2378

apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side

Published Jan 5, 2013 CVSS 2.0 · 4.3 Medium EPSS 3.9% KEV · Not listed
Description
Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-5371 Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
Github GHSA Github GHSA GHSA-vjpc-vf4f-82qg Improper Authentication in Apache CXF
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 7:34 PM
Reserved
Apr 19, 2012, 12:00 AM
Status
Modified
Published
Jan 5, 2013, 12:55 AM
Modified
Jun 16, 2026, 11:41 PM
Severity
Moderate
Public date
Jun 7, 2012, 12:00 AM