{"id":"CVE-2014-3623","aliases":["EUVD-2022-3343","GHSA-99v3-9x35-c5vf","MGASA-2014-0552","RHSA-2014:2019"],"status":"published","title":"Improper Authentication in Apache WSS4J","description":"Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.09224,"percentile":0.9538,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2014-10-30T14:00:00Z","modified":"2026-08-09T10:01:37Z","fixes":[{"ecosystem":"Maven","package":"org.apache.ws.security:wss4j","fixed_in":["1.6.17"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.wss4j:wss4j-ws-security-dom","fixed_in":["2.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:4","package":"wss4j","fixed_in":["1.6.17-1.mga4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.ws.security:wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.wss4j:wss4j-ws-security-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.ws.security:wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17"}]}],"versions":["1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.wss4j:wss4j-ws-security-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}],"versions":["2.0.0","2.0.1"]},{"source":"osv","ecosystem":"Mageia:4","package":"wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.12-1.SP1_redhat_5.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.16-2.redhat_3.1.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.12-1.SP1_redhat_5.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.16-2.redhat_3.1.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"apache-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.12-1.SP1_redhat_5.1.ep6.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el7","package":"wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.16-2.redhat_3.1.ep6.el7"}]}],"bundled":3}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache","product":"wss4j"}],"references":[{"url":"http://www.securityfocus.com/bid/70736","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0675.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://seclists.org/oss-sec/2014/q4/437","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0850.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://secunia.com/advisories/61909","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"https://issues.apache.org/jira/browse/WSS-511","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0851.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0236.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/97754","tags":["vdb-entry","x_refsource_XF","x_transferred","VDB Entry","web"]},{"url":"https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3623","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-99v3-9x35-c5vf"},{"url":"https://advisories.mageia.org/MGASA-2014-0552.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14484","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-November/142746.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:2019","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129916","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1157304","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_2019.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6153","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3623","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-3623","description":"Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.","status":"published","published":"2014-10-30T14:00:00Z","modified":"2024-08-06T10:50:17.711Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2022-3343","description":"Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.","status":"published","published":"2014-10-30T14:00:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-99v3-9x35-c5vf","title":"Improper Authentication in Apache WSS4J","description":"Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.","status":"published","published":"2022-05-13T01:09:20Z","modified":"2023-02-02T05:06:20Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:36:41.247728Z"}],"nvd":[{"id":"CVE-2014-3623","description":"Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.","status":"published","published":"2014-10-30T14:55:07.833Z","modified":"2026-06-17T00:08:38.33Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:02:56.921017Z"}],"osv":[{"id":"RHSA-2014:2019","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 security update","status":"published","published":"2024-09-13T09:20:43Z","modified":"2026-08-09T10:01:37Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"GHSA-99v3-9x35-c5vf","title":"Improper Authentication in Apache WSS4J","description":"Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.","status":"published","published":"2022-05-13T01:09:20Z","modified":"2024-12-03T06:00:17.054584Z","cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"MGASA-2014-0552","title":"Updated wss4j packages fix CVE-2014-3623","description":"Updated wss4j packages fixes security vulnerability:\n\nApache WSS4J before 1.6.17, when using TransportBinding, does not properly\nenforce the SAML SubjectConfirmation method security semantics, which allows\nremote attackers to conduct spoofing attacks via unspecified vectors\n(CVE-2014-3623).\n","status":"published","published":"2014-12-26T17:04:58Z","modified":"2026-04-16T06:23:47.814828174Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}