Lucene search

[email protected]CVE-2011-4314

HistoryJan 27, 2012 - 3:55 p.m.

CVE-2011-4314

2012-01-2715:55:04

CWE-20

[email protected]

web.nvd.nist.gov

openid4java

jboss

step2

kay framework

vulnerability

mitm

cve-2011-4314

nvd

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

6.1 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

75.3%

JSON

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

Affected configurations

NVD

Node

kay_framework_projectkay_frameworkRange≤1.0.1

kay_framework_projectkay_frameworkMatch0.0.0-

kay_framework_projectkay_frameworkMatch0.1.0

kay_framework_projectkay_frameworkMatch0.2.0

kay_framework_projectkay_frameworkMatch0.3.0

kay_framework_projectkay_frameworkMatch0.8.0

kay_framework_projectkay_frameworkMatch1.0.0

openidopenid4javaRange≤0.9.5.593

openidopenid4javaMatch0.9.2

openidopenid4javaMatch0.9.3

openidopenid4javaMatch0.9.4.339

redhatjboss_enterprise_application_platformMatch5.1.0

redhatjboss_enterprise_application_platformMatch5.1.1

redhatjboss_enterprise_application_platformMatch5.1.2

CPENameOperatorVersion
kay_framework_project:kay_frameworkkay framework project kay frameworkle1.0.1
kay_framework_project:kay_frameworkkay framework project kay frameworkeq0.0.0
kay_framework_project:kay_frameworkkay framework project kay frameworkeq0.1.0
kay_framework_project:kay_frameworkkay framework project kay frameworkeq0.2.0
kay_framework_project:kay_frameworkkay framework project kay frameworkeq0.3.0
kay_framework_project:kay_frameworkkay framework project kay frameworkeq0.8.0
kay_framework_project:kay_frameworkkay framework project kay frameworkeq1.0.0
openid:openid4javaopenid openid4javale0.9.5.593
openid:openid4javaopenid openid4javaeq0.9.2
openid:openid4javaopenid openid4javaeq0.9.3

CPE	Name	Operator	Version
kay_framework_project:kay_framework	kay framework project kay framework	le	1.0.1
kay_framework_project:kay_framework	kay framework project kay framework	eq	0.0.0
kay_framework_project:kay_framework	kay framework project kay framework	eq	0.1.0
kay_framework_project:kay_framework	kay framework project kay framework	eq	0.2.0
kay_framework_project:kay_framework	kay framework project kay framework	eq	0.3.0
kay_framework_project:kay_framework	kay framework project kay framework	eq	0.8.0
kay_framework_project:kay_framework	kay framework project kay framework	eq	1.0.0
openid:openid4java	openid openid4java	le	0.9.5.593
openid:openid4java	openid openid4java	eq	0.9.2
openid:openid4java	openid openid4java	eq	0.9.3