Improper Access Control in Apache WSS4J

MEDIUM 5.0CVE-2015-0227 · GHSA-6r5v-hp32-fjqw · Published 12/02/2015 · updated 17/06/2026

In short

CVE-2015-0227 is a MEDIUM (CVSS 5.0) vulnerability affecting org.apache.ws.security:wss4j, wss4j:wss4j, wss4j (apache).
Chance of exploitation in the next 30 days (EPSS): 7.5%, higher than 94.5% of all vulnerabilities.
Fix: update to 2.02, 1.6.17 or later.

Package	Affected versions	Patched versions
org.apache.ws.security:wss4j Maven	`≥ 2.0.0, < 2.02< 1.6.17`	`2.021.6.17`
wss4j:wss4j Maven	`< 1.6.17`	`1.6.17`
wss4j apache	`= 2.0.0= 2.0.1≤ 1.6.16`	No fix yet

Description

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

NVD description

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

References

More vulnerabilities in org.apache.ws.security:wss4j

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free