It was reported [1] that Apache CXF does not properly validate a WS-Security UsernameToken that was received as part of the security header of a SOAP request against a WS-SP UsernameToken policy. This could allow a malicious client to send a request to the endpoint with no UsernameToken, and the UsernameToken policy requirement would still be marked as valid. This has been fixed upstream [2] in versions 2.4.6 and 2.5.2 and only affected 2.4.5 and 2.5.1 users (earlier versions were not affected). [1] http://www.securityfocus.com/archive/1/521520 [2] http://svn.apache.org/viewvc?view=revision&revision=1233457
Statement: Not Vulnerable. This issue only affects Apache CXF 2.4.5 and 2.5.1. Earlier versions were not affected and later versions include a fix for this issue. This issue does not affect the versions of Apache CXF as shipped with various Red Hat products.