Login Request a demo
High severity · published Oct 30, 2017
CVE-2015-0226
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier…
7.5
CVSS
5.5%
EPSS
No
On KEV
Description
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Wss4j · Apache
through 1.6.16; 2.0; 2.0.0; 2.0.0; 2.0.1 · source: NVD
Affected product
WS
Wss4j
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0226
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0846.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0847.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0848.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0849.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1176.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1177.html
More from Wss4j
9.8
CVE-2026-88920
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
9.1
CVE-2026-89238
Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
9.1
CVE-2026-87830
Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
8.8
CVE-2020-13936
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet…
7.5
CVE-2026-95616
Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions