Description
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.axis2:axis2 | < 1.7.9 | 1.7.9 | GHSA-88r4-38gc-97p4 |
References
- [oss-security] 20120912 Re: CVE Request: Apache Axis2 XML Signature Wrapping Attack mailing-list
- [oss-security] 20120912 CVE Request: Apache Axis2 XML Signature Wrapping Attack mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=856755
- http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf
- 55508 vdb-entry