NVD

Id
28983  
Name
CVE-2014-0035  
Description
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-07-07  
Modified Date
2015-04-22  
Seq
2014-0035  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
152813 28983 CVE-2014-0035 http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc  View
152814 28983 CVE-2014-0035 RHSA-2014:0797  View
152815 28983 CVE-2014-0035 RHSA-2014:0798  View
152816 28983 CVE-2014-0035 RHSA-2014:0799  View
152817 28983 CVE-2014-0035 RHSA-2014:1351  View
152818 28983 CVE-2014-0035 RHSA-2015:0850  View
152819 28983 CVE-2014-0035 RHSA-2015:0851  View
152820 28983 CVE-2014-0035 http://svn.apache.org/viewvc?view=revision&revision=1564724  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14366 JVNDB-2014-003241 Apache CXF の SymmetricBinding における重要な情報を取得される脆弱性 Apache CXF の SymmetricBinding は、EncryptBeforeSigning が有効かつ UsernameToken ポリシーに EncryptedSupportingToken が設定されている場合、平文で UsernameToken を送信するため、重要な情報を取得される脆弱性が存在します。 CVE-2014-0035 67436 CVE-2014-0035 28983 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003241.html 2014-02-05 2015-05-08 View