CVE-2014-8152

2015-01-2118:59:04

CWE-254

[email protected]

web.nvd.nist.gov

apache santuario

xml security

java

cve-2014-8152

remote attack

streaming

signature

protection

xml document

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

6.7 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

60.2%

JSON

Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.

Affected configurations

NVD

Node

apachesantuario_xml_security_for_javaMatch2.0.0

apachesantuario_xml_security_for_javaMatch2.0.1

apachesantuario_xml_security_for_javaMatch2.0.2

CPENameOperatorVersion
apache:santuario_xml_security_for_javaapache santuario xml security for javaeq2.0.0
apache:santuario_xml_security_for_javaapache santuario xml security for javaeq2.0.1
apache:santuario_xml_security_for_javaapache santuario xml security for javaeq2.0.2

CPE	Name	Operator	Version
apache:santuario_xml_security_for_java	apache santuario xml security for java	eq	2.0.0
apache:santuario_xml_security_for_java	apache santuario xml security for java	eq	2.0.1
apache:santuario_xml_security_for_java	apache santuario xml security for java	eq	2.0.2