CVE-2012-4418 Apache Axis2 Vulnerable to XML Signature wrapping attack
MediumCVSS 5.8
EPSS 6.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.axis2/axis2(Maven) | < 1.7.9 | 1.7.9 |
| org.apache.axis2/axis2(Maven) | = 1.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.1.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.4.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.5 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.6 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.0 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.0 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.5 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.axis2/axis2(Maven) | = 1.7.6 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.7 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.8 | No fix listed |
| apache axis2 | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com
- github.com product
- issues.apache.org
- issues.apache.org
- web.archive.org
- www.nds.rub.de exploit
- [oss-security] 20120912 CVE Request: Apache Axis2 XML Signature Wrapping Attack mailing-list
- [oss-security] 20120912 Re: CVE Request: Apache Axis2 XML Signature Wrapping Attack mailing-list
- github.com
- 55508 vdb-entry