Overview
About vulnerability
Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J’s safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag, increasing exposure to attacks that target that legacy key-transport construction in man-in-the-middle or oracle-capable positions.
Preconditions include inbound XML encryption or key transport handled by WSS4J through Spring WS, peers that negotiate or emit RSA v1.5 key transport, and an attacker with a position that allows practical exploitation of the weaker algorithm choice.