CVE-2013-2172
개요
A flaw was found in the way Apache Santuario XML Security for Java validated XML signatures. Santuario allowed a signature to specify an arbitrary canonicalization algorithm, which would be applied to the SignedInfo XML fragment. A remote attacker could exploit this to spoof an XML signature via a specially crafted XML signature block.
CVSS (Common Vulnerability Scoring System) 점수 세부 사항
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v2 점수 분석
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| 기본 점수 | 5.8 | 4.3 | N/A |
| 공격 벡터 | Network | Network | N/A |
| 액세스 복잡성 | Medium | Medium | N/A |
| 인증 | None | None | N/A |
| 기밀성에 미치는 영향 | Partial | None | N/A |
| 무결성에 미치는 영향 | Partial | Partial | N/A |
| 가용성에 미치는 영향 | None | None | N/A |
벡터
Red Hat: AV:N/AC:M/Au:N/C:P/I:P/A:N
NVD: AV:N/AC:M/Au:N/C:N/I:P/A:N
취약점 이해 (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This weakness can allow an attacker to access resources which are not otherwise accessible without proper authentication.
