CVE-2014-0035

CVE-2014-0035 describes an information disclosure vulnerability in Apache CXF versions prior to 2.6.13 and 2.7.10, also affecting Red Hat JBoss Enterprise Application Platform. When EncryptBeforeSigning is enabled with an EncryptedSupportingToken, the UsernameToken is transmitted in cleartext, allowing remote attackers to intercept sensitive information via network sniffing. This vulnerability has a CVSS score of 4.3 (medium severity) due to its network-based attack vector and medium attack complexity, potentially leading to a compromise of confidentiality. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.