Unscored severity · published Jul 7, 2014
CVE-2014-0034
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to…
–
CVSS
7.4%
EPSS
No
On KEV
Description
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cxf · Apache
through 2.6.11; 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; +15 more · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
6.0.0; 6.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0034
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0034
Vendor Advisory
http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.asc
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0797.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0798.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0799.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1351.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0850.html
More from Cxf
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository