Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.apache.ws.security:wss4j(Maven) | 0 | 1.6.17 | N/A |
| org.apache.ws.security:wss4j(Maven) | 2.0.0 | 2.02 | N/A |
CVSS Metrics
