[AXIS2C-1694] CVE-2012-4418 - "XML Signature wrapping attack"

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Fix Version/s: 1.7.0
• Assignee: Unassigned
• Reporter: Matthew Kornfield
• Created: 21/Dec/17 17:03
• Updated: 07/Apr/20 19:36

Description

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4418 to
the following vulnerability:

Name: CVE-2012-4418
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4418
Assigned: 20120821
Reference: http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

Issue Links

• is a clone of: AXIS2C-1607 CVE-2012-5351 - "Signature exclusion attack," a different vulnerability than CVE-2012-4418
• relates to: AXIS2C-1607 CVE-2012-5351 - "Signature exclusion attack," a different vulnerability than CVE-2012-4418