VULNERABILITY INTELLIGENCE
CVE-2014-0034
CVSS score4.3 MEDIUM
EPSS probability7.41%
CISA KEVNot currently listed
Published2014-07-07
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:N/A:N
Description
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.
Weakness classification
- CWE-20: Improper Input Validation