CVE-2015-0227: Apache WSS4J

Medium severity, CVSS 5.0. EPSS: 7.5% chance of exploitation in the next 30 days.

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

Affected products

• Apache WSS4J: up to and including 1.6.16; version 2.0.0 only; version 2.0.1 only

Published 2015-02-12. Last modified 2026-06-17.