Input validation

2012-01-2715:55:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

75.3%

JSON

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

CPENameOperatorVersion
kay_frameworkeq1.0.0
kay_frameworkeq0.1.0
kay_frameworkle1.0.1
kay_frameworkeq0.8.0
kay_frameworkeq0.2.0
kay_frameworkeq0.0.0
kay_frameworkeq0.3.0
openid4javale0.9.5.593
openid4javaeq0.9.2
openid4javaeq0.9.4.339

Name	Operator	Version
kay_framework	eq	1.0.0
kay_framework	eq	0.1.0
kay_framework	le	1.0.1
kay_framework	eq	0.8.0
kay_framework	eq	0.2.0
kay_framework	eq	0.0.0
kay_framework	eq	0.3.0
openid4java	le	0.9.5.593
openid4java	eq	0.9.2
openid4java	eq	0.9.4.339