EUVD-2026-88142
GHSA-4jqc-cjj3-x26w
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
AC:H because the attacker must intercept a valid WSSE header before replay; PR:N since no attacker credentials are used; C:H/I:H reflect full AtomPub read/publish authority, A:L minor.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 4
AnalysisAI
Replay of a captured WSSE digest authentication header against Apache Roller 6.1.5 allows an attacker to assume the victim's AtomPub authority - publishing, editing, and deleting blog content under that identity - without ever knowing the underlying password. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, 7.7) rates it as remotely reachable without valid credentials, but real-world exposure is tightly gated: the AtomPub API must be explicitly enabled (it ships off by default), WSSE must be the configured AtomPub authentication method, the install must use plaintext-compatible password storage, and the attacker must first be able to observe a legitimate user's header in transit, which is what drives the High attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a very specific non-default deployment: the AtomPub API must be enabled (off by default), WSSE must be selected as the AtomPub authentication method, and the installation must use plaintext-compatible password storage. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-CVSS (7.7) but real-world-low-priority issue once the exploitation gating is factored in. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Roller 6.1.6 or later, which is the vendor-released fix; version 6.1.6 removes WSSE as an AtomPub authentication method entirely. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Apache Roller instance and confirm whether any run 6.1.5 with the AtomPub API enabled and WSSE as the configured authentication method; for any that do, take the API offline or disable WSSE immediately, and ensure all administrative and publishing traffic is forced over TLS to prevent header capture in transit. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today