Authentication Bypass Affecting org.apache.cxf:cxf-rt-rs-security-sso-saml Open this link in a new tab package, versions [2.7.0,2.7.18) [3.0.0,3.0.7) [3.1.0,3.1.3)


0.0
medium
  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JAVA-ORGAPACHECXF-30579

  • published

    16 Nov 2015

  • disclosed

    16 Nov 2015

  • credit

    Unknown

How to fix?

Upgrade org.apache.cxf:cxf-rt-rs-security-sso-saml to version 2.7.18, 3.0.7, 3.1.3 or higher.

Overview

org.apache.cxf:cxf-rt-rs-security-sso-saml is an open source services framework.

Affected versions of this package are vulnerable to Authentication Bypass. It allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."