CVE-2015-0227: Improper Access Control in Apache WSS4J

May 14, 2022 (updated April 17, 2026)

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to “wrapping attacks.”

References

exchange.xforce.ibmcloud.com/vulnerabilities/100837
github.com/advisories/GHSA-6r5v-hp32-fjqw
nvd.nist.gov/vuln/detail/CVE-2015-0227
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03900en_us
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Code Behaviors & Features

Detect and mitigate CVE-2015-0227 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →