# CVE-2015-0227: Apache WSS4J improper access control via wrapping attacks

Source: https://junglewise.ai/threats/cve-2015-0227-apache-wss4j-improper-access-control-via-wrapping-attacks  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-14. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2015-0227 · Severity: medium · Published 2022-05-14

Apache WSS4J is a library used to secure Java-based web services. A vulnerability in how it handles security headers allows attackers to bypass requirements for signed or encrypted data. This could allow an unauthorized person to send malicious messages that the system incorrectly trusts, potentially leading to unauthorized access or data manipulation.

Technologies: [org.apache.ws.security:wss4j (Maven)](https://junglewise.ai/threats/technologies/org-apache-ws-security-wss4j). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2015-0227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-0227 being exploited in the wild.

**How severe is CVE-2015-0227?** Medium severity, published 14 May 2022.

**Which products and versions are affected?** Apache Software Foundation WSS4J < 1.6.17, >= 2.0.0, < 2.0.2; org.apache.ws.security:wss4j (Maven) ECOSYSTEM:introduced=0,fixed=1.6.17; wss4j:wss4j (Maven) ECOSYSTEM:introduced=0,fixed=1.6.17.

**Is there a fix for CVE-2015-0227?** Yes. org.apache.ws.security:wss4j (Maven): upgrade to 1.6.17 or later; wss4j:wss4j (Maven): upgrade to 1.6.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-0227 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2015-0227?** Check whether you run Apache Software Foundation WSS4J, org.apache.ws.security:wss4j (Maven) or wss4j:wss4j (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.ws.security:wss4j (Maven): upgrade to 1.6.17 or later

  ```sh
  # set org.apache.ws.security:wss4j to 1.6.17 in your pom.xml or build.gradle
  ```

- wss4j:wss4j (Maven): upgrade to 1.6.17 or later

  ```sh
  # set wss4j:wss4j to 1.6.17 in your pom.xml or build.gradle
  ```


## Technical details

Apache WSS4J is susceptible to XML Signature Wrapping (XSW) attacks. The vulnerability exists because the library incorrectly validates security constraints when the 'requireSignedEncryptedDataElements' configuration is enabled. A remote, unauthenticated attacker can exploit this by manipulating the XML structure of a SOAP message to include unauthorized elements that bypass signature or encryption checks. This allows the attacker to perform actions with the privileges of a trusted sender. The issue is resolved in versions 1.6.17 and 2.0.2.

## Affected products

- Apache WSS4J < 1.6.17, >= 2.0.0, < 2.0.2

## Identifiers

- CVE-2015-0227
- GHSA-6r5v-hp32-fjqw

## Timeline

- 2015-02-12: disclosed
- 2015-02-12: advisory
- 2022-05-14: other: Advisory published to GitHub database

## References

- [https://api.github.com/users/kmoens](https://api.github.com/users/kmoens)
- [https://github.com/kmoens](https://github.com/kmoens)
- [https://api.github.com/users/kmoens/gists%7B/gist_id%7D](https://api.github.com/users/kmoens/gists%7B/gist_id%7D)
- [https://api.github.com/users/kmoens/repos](https://api.github.com/users/kmoens/repos)
- [https://avatars.githubusercontent.com/u/5837260?v=4](https://avatars.githubusercontent.com/u/5837260?v=4)
- [https://api.github.com/users/kmoens/events%7B/privacy%7D](https://api.github.com/users/kmoens/events%7B/privacy%7D)

## Related threats

- [Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J](https://junglewise.ai/threats/cve-2015-0226-use-of-a-broken-or-risky-cryptographic-algorithm-in-apache-wss4j)
- [Improper Authentication in Apache WSS4J](https://junglewise.ai/threats/cve-2014-3623-improper-authentication-in-apache-wss4j)
- [Apache WSS4J and JBossWS Bleichenbacher attack in XML Encryption](https://junglewise.ai/threats/cve-2011-2487-apache-wss4j-and-jbossws-bleichenbacher-attack-in-xml-encryption)