Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2015-0226

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
apache / wss4j 2.0.0 2.0.0.x
apache / wss4j 2.0.1 2.0.1.x
apache / wss4j - 1.6.16.x
apache / wss4j 2.0.0-rc1 2.0.0-rc1.x
apache / wss4j 2.0-beta 2.0-beta.x
org.apache.ws.security / wss4j - 1.6.17
org.apache.ws.security / wss4j 2.0.0 2.02