CVE-2015-0227
apache wss4j: no CVSS score yet. EPSS 7.5% chance of exploitation in the next 30 days. Fixed in org.apache.ws.security:wss4j 1.6.17, 2.02.
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
- EPSS
- 7.5% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:wss4j
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6r5v-hp32-fjqw | Maven | org.apache.ws.security:wss4j | <1.6.17 | 1.6.17 |
| GHSA-6r5v-hp32-fjqw | Maven | org.apache.ws.security:wss4j | >=2.0.0 <2.02 | 2.02 |
| GHSA-6r5v-hp32-fjqw | Maven | wss4j:wss4j | <1.6.17 | 1.6.17 |