GHSA-6r5v-hp32-fjqwMedium

Improper Access Control in Apache WSS4J

Published
May 14, 2022
Last Modified
April 17, 2026

🔗 CVE IDs covered (1)

CVE-2015-0227 →

📋 Description

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

🎯 Affected products3

  • maven/org.apache.ws.security:wss4j:< 1.6.17
  • maven/org.apache.ws.security:wss4j:>= 2.0.0, < 2.02
  • maven/wss4j:wss4j:< 1.6.17

🔗 References (13)