CVE-2014-0034
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.
- EPSS
- 7.4% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
- redhat:jboss_enterprise_application_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-38x2-fp9m-87mx | Maven | org.apache.cxf:cxf-rt-ws-security | <2.6.12 | 2.6.12 |
| GHSA-38x2-fp9m-87mx | Maven | org.apache.cxf:cxf-rt-ws-security | >=2.7.0 <2.7.9 | 2.7.9 |