Description

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

Remediation

References

CVE-2014-0034

Related Vulnerabilities

LimeSurvey Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2022-48008)

WordPress Plugin Theme My Login 'instance' Parameter Cross-Site Scripting (6.1.4)

PrestaShop Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2023-30151)

WordPress Plugin BSK PDF Manager SQL Injection (3.1.1)

SugarCRM Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-17298)

Severity

Medium

Classification

CVE-2014-0034 CWE-20

Tags

Missing Update Known Vulnerabilities