CVE-2011-4314
Published Jan 27, 2012
Last updated 12 years ago
Overview
- Description
- message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 5.8
- Impact score
- 4.9
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:N/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-20
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kay_framework_project:kay_framework:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C34585EE-6B3D-4BAA-A48B-355751340745",
"versionEndIncluding": "1.0.1"
},
{
"criteria": "cpe:2.3:a:kay_framework_project:kay_framework:0.0.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "497F44FA-8826-4F7D-97E3-D2AA02734A05"
},
{
"criteria": "cpe:2.3:a:kay_framework_project:kay_framework:0.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0CB7EFD-538C-4573-9C5E-51CE3EFE4942"
},
{
"criteria": "cpe:2.3:a:kay_framework_project:kay_framework:0.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFD65FAE-117F-4836-8F18-0993FC7273E8"
},
{
"criteria": "cpe:2.3:a:kay_framework_project:kay_framework:0.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "395C136F-0B5D-46E1-BF57-2D71677282BB"
},
{
"criteria": "cpe:2.3:a:kay_framework_project:kay_framework:0.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3AE498E3-51AB-4E12-BD4C-D1FF6729E238"
},
{
"criteria": "cpe:2.3:a:kay_framework_project:kay_framework:1.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC6154A9-F506-47B3-94B8-ACA20BCB4C86"
},
{
"criteria": "cpe:2.3:a:openid:openid4java:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9618CEF-6F14-469A-A27E-5FEDDC0B939A",
"versionEndIncluding": "0.9.5.593"
},
{
"criteria": "cpe:2.3:a:openid:openid4java:0.9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "434CDA90-8E27-45AC-8235-91E1FAACA016"
},
{
"criteria": "cpe:2.3:a:openid:openid4java:0.9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0D0288B-293C-4DAF-A2F0-A8CDA9B5FD3A"
},
{
"criteria": "cpe:2.3:a:openid:openid4java:0.9.4.339:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9EC5D95-9C93-4B71-8C90-1451FB863DA7"
},
{
"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "972C5C87-E982-44A5-866D-FDEACB5203B8"
},
{
"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C13890AE-5FDE-4698-8A2E-1B2FA0A313AF"
},
{
"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A785F07-9B76-4153-B676-29C9682B2F73"
}
],
"operator": "OR"
}
]
}
]