NVD

Id
28982  
Name
CVE-2014-0034  
Description
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-07-07  
Modified Date
2015-04-22  
Seq
2014-0034  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
152804 28982 CVE-2014-0034 http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.asc  View
152805 28982 CVE-2014-0034 RHSA-2014:0797  View
152806 28982 CVE-2014-0034 RHSA-2014:0798  View
152807 28982 CVE-2014-0034 RHSA-2014:0799  View
152808 28982 CVE-2014-0034 RHSA-2014:1351  View
152809 28982 CVE-2014-0034 RHSA-2015:0850  View
152810 28982 CVE-2014-0034 RHSA-2015:0851  View
152811 28982 CVE-2014-0034 http://svn.apache.org/viewvc?view=revision&revision=1551228  View
152812 28982 CVE-2014-0034 68441  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14365 JVNDB-2014-003240 Apache CXF の SecurityTokenService におけるアクセス権を取得される脆弱性 Apache CXF の SecurityTokenService (STS) は、キャッシュが有効になっている場合、SAML トークンを適切に検証しないため、アクセス権を取得される脆弱性が存在します。 CVE-2014-0034 67435 CVE-2014-0034 28982 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003240.html 2014-06-26 2015-05-08 View