CVE-2012-5351 Improper Authentication in Apache Axis2
MediumCVSS 6.4
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.axis2/axis2(Maven) | < 1.6.4 | 1.6.4 |
| org.apache.axis2/axis2(Maven) | = 1.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.1.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.4.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.5 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.6 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.0 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.3 | No fix listed |
| apache axis2 | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- apache-axis2-saml-sec-bypass(79487) vdb-entry
- www.oracle.com
- www.nds.rub.de
- github.com