message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://openid.net/2011/05/05/attribute-exchange-security-alert/ - Patch, Vendor Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2012-0441.html - | |
| References | () http://rhn.redhat.com/errata/RHSA-2012-0519.html - | |
| References | () http://secunia.com/advisories/44496 - Vendor Advisory | |
| References | () http://secunia.com/advisories/48697 - | |
| References | () http://secunia.com/advisories/48954 - | |
| References | () http://securitytracker.com/id?1026400 - | |
| References | () http://www.openwall.com/lists/oss-security/2011/11/16/1 - | |
| References | () http://www.openwall.com/lists/oss-security/2011/11/17/1 - | |
| References | () http://www.redhat.com/support/errata/RHSA-2011-1804.html - | |
| References | () https://issues.jboss.org/browse/JBEPP-1368 - | |
| References | () https://issues.jboss.org/browse/SOA-3597 - |
Information
Published : 2012-01-27 15:55
Updated : 2024-11-21 01:32
NVD link : CVE-2011-4314
Mitre link : CVE-2011-4314
CVE.ORG link : CVE-2011-4314
JSON object : View
Products Affected
redhat
- jboss_enterprise_application_platform
kay_framework_project
- kay_framework
openid
- openid4java
CWE
CWE-20
Improper Input Validation