Unscored severity · published Feb 12, 2015
CVE-2015-0227
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
–
CVSS
7.5%
EPSS
No
On KEV
Exploitation
Is it being used?
Exploit prediction (EPSS)7.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Wss4j · Apache
through 1.6.16; 2.0.0; 2.0.0; 2.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0227
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0773.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0846.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0847.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0848.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-0849.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1176.html
More from Wss4j
9.8
CVE-2026-88920
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
9.1
CVE-2026-89238
Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
9.1
CVE-2026-87830
Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
8.8
CVE-2020-13936
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet…
7.5
CVE-2026-95616
Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions