CVE-2014-3623: Medium severity apache wss4j vulnerability
Apache WSS4J as used by Apache CXF with the TransportBinding does not, by default, properly enforce all security requirements associcated with SAML SubjectConfirmation methods. Web service endpoints, secured by WSS4j, that rely on SAML for authentication are considered vulnerable to types of spoofing attacks.
Upstream Issues:
https://issues.apache.org/jira/browse/WSS-510 https://issues.apache.org/jira/browse/WSS-511 https://issues.apache.org/jira/browse/WSS-511
Upstream Commits:
http://svn.apache.org/viewvc?view=revision&revision=1624308 http://svn.apache.org/viewvc?view=revision&revision=1624287 http://svn.apache.org/viewvc?view=revision&revision=1624262
References:
http://cxf.apache.org/security-advisories.data/CVE-2014-3623.txt.asc
Other sources
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3623?
CVE-2014-3623 is considered a moderate to high severity vulnerability due to its impact on authentication mechanisms in secured web service endpoints.
How do I fix CVE-2014-3623?
To remediate CVE-2014-3623, upgrade Apache WSS4J to versions 1.6.17 or 2.0.2, or Apache CXF to versions 2.7.13 or 3.0.2.
What types of applications are affected by CVE-2014-3623?
Applications using Apache WSS4J with the TransportBinding configuration for SAML authentication may be affected by CVE-2014-3623.
What could happen if CVE-2014-3623 is exploited?
Exploitation of CVE-2014-3623 may allow attackers to spoof identities and gain unauthorized access to protected web service endpoints.
Is CVE-2014-3623 a known issue in specific versions of software?
Yes, CVE-2014-3623 affects certain versions of Apache WSS4J, Apache CXF, and WildFly as outlined in the vulnerability description.