XML Signature Spoofing in Apache Santuario XML Security for Java

CVE-2013-2172

Summary

The vulnerability in Apache Santuario XML Security for Java is caused by the ability for context-dependent attackers to spoof an XML Signature. This is achieved through a flaw in the CanonicalizationMethod parameter, which allows an attacker to specify a weak canonicalization algorithm for the SignedInfo part of the Signature. As a result, the integrity and authenticity of XML documents can be compromised, leading to potential security breaches and exploitation of sensitive data.

References