CVE-2012-5575

Опубликовано: 19 авг. 2013

Источник: nvd

CVSS2: 6.4

EPSS Низкий

Описание

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:cxf:2.5.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.7.3:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_fuse_esb_enterprise:7.1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.06322

Низкий

6.4 Medium

CVSS2

Дефекты

CWE-310

Связанные уязвимости

CVE-2012-5575

redhat

больше 13 лет назад

GHSA-7v5v-9v8r-w864

github

около 4 лет назад

Inadequate Encryption Strength in Apache CXF