CyberRota Analysis
AI-GeneratedApache WSS4J is vulnerable to an authentication bypass that enables unauthenticated remote attackers to forge authenticated SOAP messages by exploiting a crafted unsigned SAML sender-vouches assertion with a malicious key. This could lead to unauthorized access and manipulation of sensitive data within applications using this library. Organizations utilizing affected versions should prioritize upgrading to versions 4.0.2, 3.0.6, or 2.4.4 to mitigate this risk.
Original NVD Description
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)