Vulnerability Details : CVE-2014-0035
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
Exploit prediction scoring system (EPSS) score for CVE-2014-0035
Probability of exploitation activity in the next 30 days: 0.21%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 58 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-0035
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2014-0035
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0035
-
http://rhn.redhat.com/errata/RHSA-2014-0797.html
Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2015-0851.html
RHSA-2015:0851 - Security Advisory - Red Hat Customer Portal
-
https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html - Pony Mail
-
http://rhn.redhat.com/errata/RHSA-2014-1351.html
RHSA-2014:1351 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2015-0850.html
RHSA-2015:0850 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2014-0798.html
RHSA-2014:0798 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2014-0799.html
RHSA-2014:0799 - Security Advisory - Red Hat Customer Portal
-
https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.htm
-
https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html - Pony Mail
-
https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html - Pony Mail
-
https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html - Pony Mail
-
http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc
Vendor Advisory
-
https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html - Pony Mail
-
http://svn.apache.org/viewvc?view=revision&revision=1564724
[Apache-SVN] Revision 1564724Patch
Products affected by CVE-2014-0035
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cxf:2.7.9:*:*:*:*:*:*:*