Description

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

Remediation

References

CVE-2014-0035

Related Vulnerabilities

Drupal Core 5.x Multiple Security Bypass Vulnerabilities (5.0 - 5.22)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-41184)

Plone CMS CVE-2013-4189 Vulnerability (CVE-2013-4189)

Oracle Database Server CVE-2012-1737 Vulnerability (CVE-2012-1737)

WebLogic Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') Vulnerability (CVE-2018-1000613)

Severity

Medium

Classification

CVE-2014-0035

Tags

Missing Update Known Vulnerabilities