Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache CXF 加密问题漏洞
Vulnerability Description
Apache CXF是美国阿帕奇（Apache）软件基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。 Apache CXF 2.5.10之前的2.5.x版本，2.6.7之前的2.6.x版本，以及2.7.4之前的2.7.x版本中存在加密问题漏洞。该漏洞源于程序在对某指定加密算法进行解密之前，没有校验它是否已通过WS-SecurityPolicy AlgorithmSuite的定义。远程攻击者可利用该漏洞强制CXF使用比预期更弱的加密算法并使其更容易解密通信。
CVSS Information
N/A
Vulnerability Type
N/A