Apache WSS4J Configuration Bypass Vulnerability

CVE-2015-0227

Summary

Apache WSS4J versions prior to 1.6.17 and 2.x before 2.0.2 are affected by a vulnerability that allows remote attackers to bypass the requireSignedEncryptedDataElements setting. This occurs through specific vectors associated with wrapping attacks, enabling malicious actors to manipulate SOAP messages without proper security controls. Users of vulnerable versions should consider upgrading to mitigate potential risks.

References