Description

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

Remediation

References

CVE-2014-0034

Related Vulnerabilities

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-3325)

WordPress Plugin ALD-Dropshipping and Fulfillment for AliExpress and WooCommerce Multiple Vulnerabilities (1.0.21)

WordPress 3.9.x Same Origin Method Execution (SOME) Vulnerability (3.9 - 3.9.11)

MySQL CVE-2016-3486 Vulnerability (CVE-2016-3486)

WebLogic CVE-2020-14639 Vulnerability (CVE-2020-14639)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2014-0034