CVE-2012-5351

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.

Score

CVSS 2.0 6.4 Medium

Status

Modified - cve@mitre.org

Published

2012-10-09

Last modified

2024-08-06

Weaknesses

CWE-287

Affected products

• Axis2 (Apache)

References

• http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79487
• https://www.oracle.com/security-alerts/cpuapr2022.html