CVE-2011-4314: kay_framework_project kay_framework Improper Input Validation

CVSS: 5.8v2.0MediumModified

AliasesRHSA-2011:1802RHSA-2011:1803RHSA-2011:1804+2 more

Published 27-01-2012Last modified 07-08-2024

Vulnerability summary

CVE-2011-4314 is a medium (CVSS 5.8) Improper Input Validation vulnerability in kay_framework_project kay_framework. EPSS estimates a 3.07% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities.

Overall risk

24/100

0100

Low · default modelHow is this calculated?

CVSS score

5.8/10

010

Medium · v2.0 (NVD)

EPSS score

3.07%

0%100%

Low · -0.03 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3

RHSA-2011:1798 RHSA-2011:1799 RHSA-2011:1800

Timeline

27-01-2012
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

CVSS metrics

1 score · 1 source · 1 version

v2.05.8

EPSS trend

Probability

3.07%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

-0.03 pp

From 3.10% on 18-09-2026

18-09-202618-10-2026

EPSS score

3.07%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Redhat93 products

jboss_enterprise_application_platform5.1.0 | 5.1.1 | 5.1.2
apache-cxf< 0:2.2.12-4.patch_02.1.ep5.el6 | < 0:2.2.12-4.patch_02.1.1.ep5.el5 | < 0:2.2.12-4.patch_02.1.1.ep5.el4
cglib< 0:2.2-5.5.ep5.el6 | < 0:2.2-5.3.ep5.el5 | < 0:2.2-5.3.ep5.el4
facelets< 0:1.1.15-3.B1_patch_01.2.ep5.el6 | < 0:1.1.15-3.B1_patch_01.2.ep5.el5 | < 0:1.1.15-3.B1_patch_01.2.ep5.el4
glassfish-jaxb< 0:2.1.12-10_patch_02.ep5.el6 | < 0:2.1.12-10_patch_02.ep5.el5 | < 0:2.1.12-10_patch_02.ep5.el4

glassfish-jsf< 0:1.2_13-5_patch_01.3.ep5.el6 | < 0:1.2_13-5_patch_01.3.ep5.el5 | < 0:1.2_13-5_patch_01.3.ep5.el4
jacorb-jboss< 0:2.3.1-10.patch_03.4.ep5.el6 | < 0:2.3.1-10.patch_03.4.ep5.el5 | < 0:2.3.1-10.patch_03.4.ep5.el4
jakarta-commons-logging-jboss< 0:1.1-10.3_patch_02.1.ep5.el6 | < 0:1.1-10.3_patch_02.1.ep5.el5 | < 0:1.1-10.3_patch_02.1.ep5.el4
jboss-aop2< 0:2.1.6-2.CP03.1.1.ep5.el6 | < 0:2.1.6-2.CP03.1.1.ep5.el5 | < 0:2.1.6-2.CP03.1.1.ep5.el4
jboss-cache-core< 0:3.2.8-1.ep5.el6 | < 0:3.2.8-1.ep5.el5 | < 0:3.2.8-1.ep5.el4
jboss-cl< 0:2.0.10-1.2.ep5.el6 | < 0:2.0.10-1.2.ep5.el5 | < 0:2.0.10-1.2.ep5.el4
jboss-cluster-ha-client< 0:1.1.4-1.1.ep5.el6 | < 0:1.1.4-1.1.ep5.el5 | < 0:1.1.4-1.1.ep5.el4
jboss-common-core< 0:2.2.18-1.1.ep5.el6 | < 0:2.2.18-1.1.ep5.el5 | < 0:2.2.18-1.1.ep5.el4
jboss-eap5-native< 0:5.1.2-1.4.ep5.el6 | < 0:5.1.2-1.4.ep5.el5 | < 0:5.1.2-1.4.ep5.el4
jboss-ejb3-core< 0:1.3.8-0.1.ep5.el6 | < 0:1.3.8-0.1.ep5.el5 | < 0:1.3.8-0.1.ep5.el4
jboss-ejb3-proxy-clustered< 0:1.0.3-2.SP1.1.ep5.el6 | < 0:1.0.3-2.SP1.1.ep5.el5 | < 0:1.0.3-2.SP1.1.ep5.el4
jboss-ejb3-proxy-impl< 0:1.0.6-2.SP2.1.ep5.el6 | < 0:1.0.6-2.SP2.1.ep5.el5 | < 0:1.0.6-2.SP2.1.ep5.el4
jboss-el< 0:1.0_02-0.CR6.2.ep5.el6 | < 0:1.0_02-0.CR6.2.ep5.el5 | < 0:1.0_02-0.CR6.2.ep5.el4
jboss-naming< 0:5.0.3-3.CP01.3.ep5.el6 | < 0:5.0.3-3.CP01.3.1.ep5.el5 | < 0:5.0.3-3.CP01.3.1.ep5.el4
jboss-remoting< 0:2.5.4-9.SP3.1.ep5.el6 | < 0:2.5.4-9.SP3.1.ep5.el5 | < 0:2.5.4-9.SP3.1.ep5.el4
jboss-seam2< 0:2.2.5.EAP5-7.ep5.el6 | < 0:2.2.5.EAP5-5.ep5.el5 | < 0:2.2.5.EAP5-6.ep5.el4
jboss-seam2-docs< 0:2.2.5.EAP5-7.ep5.el6 | < 0:2.2.5.EAP5-5.ep5.el5 | < 0:2.2.5.EAP5-6.ep5.el4
jboss-seam2-examples< 0:2.2.5.EAP5-7.ep5.el6 | < 0:2.2.5.EAP5-5.ep5.el5 | < 0:2.2.5.EAP5-6.ep5.el4
jboss-seam2-runtime< 0:2.2.5.EAP5-7.ep5.el6 | < 0:2.2.5.EAP5-5.ep5.el5 | < 0:2.2.5.EAP5-6.ep5.el4
jboss-security-spi< 1:2.0.4-6.SP8.1.ep5.el6 | < 1:2.0.4-6.SP8.1.ep5.el5 | < 1:2.0.4-6.SP8.1.ep5.el4
jbossas-web< 0:5.1.2-7.ep5.el6 | < 0:5.1.2-7.ep5.el5 | < 0:5.1.2-7.ep5.el4
jbossas-web-client< 0:5.1.2-7.ep5.el6 | < 0:5.1.2-7.ep5.el5 | < 0:5.1.2-7.ep5.el4
jbossas-web-tp-licenses< 0:5.1.2-6.ep5.el6 | < 0:5.1.2-8.ep5.el5 | < 0:5.1.2-8.ep5.el4
jbossas-web-ws-native< 0:5.1.2-7.ep5.el6 | < 0:5.1.2-7.ep5.el5 | < 0:5.1.2-7.ep5.el4
jbossas-ws-cxf-ewp< 0:5.1.2-6.ep5.el6 | < 0:5.1.2-6.ep5.el5 | < 0:5.1.2-6.ep5.el4
jbosssx2< 0:2.0.4-6.SP8.2.ep5.el6 | < 0:2.0.4-6.SP8.2.ep5.el5 | < 0:2.0.4-6.SP8.2.ep5.el4
jbossts< 1:4.6.1-11.CP12.4.ep5.el6 | < 1:4.6.1-11.CP12.4.ep5.el5 | < 1:4.6.1-11.CP12.4.ep5.el4
jbossts-javadoc< 1:4.6.1-11.CP12.4.ep5.el6 | < 1:4.6.1-11.CP12.4.ep5.el5 | < 1:4.6.1-11.CP12.4.ep5.el4
jbossweb< 0:2.1.12-1.4_patch_01.ep5.el6 | < 0:2.1.12-1.4_patch_01.ep5.el5 | < 0:2.1.12-1.4_patch_01.ep5.el4
jbossweb-el-1.0-api< 0:2.1.12-1.4_patch_01.ep5.el6 | < 0:2.1.12-1.4_patch_01.ep5.el5 | < 0:2.1.12-1.4_patch_01.ep5.el4
jbossweb-jsp-2.1-api< 0:2.1.12-1.4_patch_01.ep5.el6 | < 0:2.1.12-1.4_patch_01.ep5.el5 | < 0:2.1.12-1.4_patch_01.ep5.el4
jbossweb-lib< 0:2.1.12-1.4_patch_01.ep5.el6 | < 0:2.1.12-1.4_patch_01.ep5.el5 | < 0:2.1.12-1.4_patch_01.ep5.el4
jbossweb-servlet-2.5-api< 0:2.1.12-1.4_patch_01.ep5.el6 | < 0:2.1.12-1.4_patch_01.ep5.el5 | < 0:2.1.12-1.4_patch_01.ep5.el4
jbossws< 0:3.1.2-7.SP11.4.ep5.el6 | < 0:3.1.2-7.SP11.4.ep5.el5 | < 0:3.1.2-7.SP11.4.ep5.el4
jbossws-common< 0:1.1.0-6.SP8_patch_01.1.ep5.el6 | < 0:1.1.0-6.SP8_patch_01.1.ep5.el5 | < 0:1.1.0-6.SP8_patch_01.1.ep5.el4
jbossws-framework< 0:3.1.2-6.SP10.1.ep5.el6 | < 0:3.1.2-6.SP10.2.ep5.el5 | < 0:3.1.2-6.SP10.2.ep5.el4
jbossws-spi< 0:1.1.2-5.SP7.1.ep5.el6 | < 0:1.1.2-5.SP7.1.ep5.el5 | < 0:1.1.2-5.SP7.1.ep5.el4
jgroups< 1:2.6.20-1.1.ep5.el6 | < 1:2.6.20-1.1.ep5.el5 | < 1:2.6.20-1.1.ep5.el4
jopr-embedded< 0:1.3.4-18.SP5.8.ep5.el6 | < 0:1.3.4-18.SP5.8.ep5.el5 | < 0:1.3.4-18.SP5.8.ep5.el4
jopr-hibernate-plugin< 0:3.0.0-13.EmbJopr4.ep5.el6 | < 0:3.0.0-13.EmbJopr4.ep5.el5 | < 0:3.0.0-14.EmbJopr4.ep5.el4
jopr-jboss-as-5-plugin< 0:3.0.0-12.EmbJopr4.ep5.el6 | < 0:3.0.0-12.EmbJopr4.ep5.el5 | < 0:3.0.0-13.EmbJopr4.ep5.el4
jopr-jboss-cache-v3-plugin< 0:3.0.0-14.EmbJopr4.ep5.el6 | < 0:3.0.0-14.EmbJopr4.ep5.el5 | < 0:3.0.0-14.EmbJopr4.ep5.el4
mod_cluster< 0:1.0.10-3.2.GA_CP02.ep5.el6 | < 0:1.0.10-3.1.GA_CP02.ep5.el5 | < 0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-demo< 0:1.0.10-3.2.GA_CP02.ep5.el6 | < 0:1.0.10-3.1.GA_CP02.ep5.el5 | < 0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-jbossas< 0:1.0.10-3.2.GA_CP02.ep5.el6 | < 0:1.0.10-3.1.GA_CP02.ep5.el5 | < 0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-jbossweb2< 0:1.0.10-3.2.GA_CP02.ep5.el6 | < 0:1.0.10-3.1.GA_CP02.ep5.el5 | < 0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-native< 0:1.0.10-3.1.1.GA_CP02.ep5.el6 | < 0:1.0.10-3.1.GA_CP02.ep5.el5 | < 0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-native-debuginfo< 0:1.0.10-3.GA_CP02.ep5.el4
mod_cluster-tomcat6< 0:1.0.10-3.2.GA_CP02.ep5.el6 | < 0:1.0.10-3.1.GA_CP02.ep5.el5 | < 0:1.0.10-3.GA_CP02.ep5.el4
org-mc4j-ems< 0:1.2.15.1-7.ep5.el6 | < 0:1.2.15.1-4.ep5.el5 | < 0:1.2.15.1-4.ep5.el4
picketlink-federation< 0:2.0.2-1.ep5.el6 | < 0:2.0.2-1.1.ep5.el5 | < 0:2.0.2-1.1.ep5.el4
picketlink-federation-webapp-idp< 0:2.0.2-1.ep5.el6 | < 0:2.0.2-1.1.ep5.el5 | < 0:2.0.2-1.1.ep5.el4
picketlink-federation-webapp-pdp< 0:2.0.2-1.ep5.el6 | < 0:2.0.2-1.1.ep5.el5 | < 0:2.0.2-1.1.ep5.el4
picketlink-federation-webapp-sts< 0:2.0.2-1.ep5.el6 | < 0:2.0.2-1.1.ep5.el5 | < 0:2.0.2-1.1.ep5.el4
resteasy< 0:1.2.1-9.CP02.5.ep5.el6 | < 0:1.2.1-9.CP02.4.ep5.el5 | < 0:1.2.1-9.CP02.4.ep5.el4
resteasy-examples< 0:1.2.1-9.CP02.5.ep5.el6 | < 0:1.2.1-9.CP02.4.ep5.el5 | < 0:1.2.1-9.CP02.4.ep5.el4
resteasy-javadoc< 0:1.2.1-9.CP02.5.ep5.el6 | < 0:1.2.1-9.CP02.4.ep5.el5 | < 0:1.2.1-9.CP02.4.ep5.el4
resteasy-manual< 0:1.2.1-9.CP02.5.ep5.el6 | < 0:1.2.1-9.CP02.4.ep5.el5 | < 0:1.2.1-9.CP02.4.ep5.el4
rh-ewp-docs< 0:5.1.2-4.ep5.el6 | < 0:5.1.2-4.ep5.el5 | < 0:5.1.2-4.ep5.el4
rh-ewp-docs-examples< 0:5.1.2-4.ep5.el6 | < 0:5.1.2-4.ep5.el5 | < 0:5.1.2-4.ep5.el4
rhq< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-ant-bundle-common< 0:3.0.0-20.EmbJopr4.ep5.el6
rhq-common-parent< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-core-client-api< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-core-comm-api< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-core-dbutils< 0:3.0.0-20.EmbJopr4.ep5.el6
rhq-core-domain< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-core-gui< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-core-native-system< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-core-parent< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-core-plugin-api< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-core-plugin-container< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-core-plugindoc< 0:3.0.0-20.EmbJopr4.ep5.el6
rhq-core-util< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-filetemplate-bundle-common< 0:3.0.0-20.EmbJopr4.ep5.el6
rhq-helpers< 0:3.0.0-20.EmbJopr4.ep5.el6
rhq-jboss-as-common< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-jmx-plugin< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-modules-parent< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-parent< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-platform-plugin< 0:3.0.0-13.EmbJopr4.ep5.el6 | < 0:3.0.0-13.EmbJopr4.ep5.el5 | < 0:3.0.0-14.EmbJopr4.ep5.el4
rhq-plugin-validator< 0:3.0.0-20.EmbJopr4.ep5.el6
rhq-pluginAnnotations< 0:3.0.0-20.EmbJopr4.ep5.el6
rhq-pluginGen< 0:3.0.0-20.EmbJopr4.ep5.el6
rhq-plugins-parent< 0:3.0.0-20.EmbJopr4.ep5.el6 | < 0:3.0.0-20.EmbJopr4.ep5.el5 | < 0:3.0.0-21.EmbJopr4.ep5.el4
rhq-rtfilter< 0:3.0.0-20.EmbJopr4.ep5.el6
slf4j< 0:1.5.8-10_patch_01.2.ep5.el6 | < 0:1.5.8-10_patch_01.2.ep5.el5 | < 0:1.5.8-10_patch_01.2.ep5.el4
xalan-j2< 0:2.7.1-6_patch_05.1.ep5.el6 | < 0:2.7.1-6_patch_05.1.ep5.el5 | < 0:2.7.1-6_patch_05.1.ep5.el4

Show all 93

Debian1 product

openid4java< 0.9.6.662-1

Kay_framework_project1 product

kay_framework≤ 1.0.1 | 0.0.0 | 0.1.0 | 0.2.0 | 0.3.0 | 0.8.0 | 1.0.0

Openid1 product

openid4java≤ 0.9.5.593 | 0.9.2 | 0.9.3 | 0.9.4.339

Org.openid4java1 product

openid4java< 0.9.6

5 vendors · 97 products

References

32 links

www.redhat.com/support/errata/RHSA-2011-1804.htmlVendor AdvisoryX Refsource REDHATWEB
secunia.com/advisories/44496Third Party AdvisoryX Refsource SECUNIAVendor Advisory
openid.net/2011/05/05/attribute-exchange-security-alert/X Refsource CONFIRMPatchVendor Advisory
rhn.redhat.com/errata/RHSA-2012-0519.htmlVendor AdvisoryX Refsource REDHATWEB
secunia.com/advisories/48954Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2012-0441.htmlVendor AdvisoryX Refsource REDHATWEB
www.openwall.com/lists/oss-security/2011/11/16/1Mailing ListX Refsource MLISTWEB
issues.jboss.org/browse/SOA-3597X Refsource CONFIRMWEB
issues.jboss.org/browse/JBEPP-1368X Refsource CONFIRMWEB
securitytracker.com/id?1026400VDB EntryX Refsource SECTRACK

Show all 32 references

www.openwall.com/lists/oss-security/2011/11/17/1Mailing ListX Refsource MLISTWEB
secunia.com/advisories/48697Third Party AdvisoryX Refsource SECUNIA
access.redhat.com/errata/RHSA-2011:1802Advisory
access.redhat.com/security/updates/classification/ARTICLE
docs.redhat.com/docs/en-US/index.htmlARTICLE
access.redhat.com/support/offerings/techpreview/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=733745REPORT
bugzilla.redhat.com/show_bug.cgi?id=754386REPORT
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1802.jsonAdvisory
access.redhat.com/security/cve/CVE-2011-4314REPORT
www.cve.org/CVERecord?id=CVE-2011-4314Advisory
nvd.nist.gov/vuln/detail/CVE-2011-4314Advisory
access.redhat.com/errata/RHSA-2011:1803Advisory
bugzilla.redhat.com/show_bug.cgi?id=733746REPORT
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1803.jsonAdvisory
access.redhat.com/errata/RHSA-2011:1804Advisory
bugzilla.redhat.com/show_bug.cgi?id=733747REPORT
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1804.jsonAdvisory
security-tracker.debian.org/tracker/CVE-2011-4314Advisory
github.com/jbufu/openid4javaPACKAGE
web.archive.org/web/20201207151157/http://securitytracker.com/id?1026400WEB
openid.net/2011/05/05/attribute-exchange-security-alertWEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities