Unscored severity · published Jul 7, 2014
CVE-2014-0035
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken,…
–
CVSS
7.1%
EPSS
No
On KEV
Description
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.1% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cxf · Apache
through 2.6.12; 2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; +17 more · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
6.0.0; 6.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0035
Vendor Advisory
http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0797.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0798.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0799.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1351.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0850.html
More from Cxf
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository