---
cve: 2013-0239
title: "jbossws-cxf, apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate"
description: > 
    It was found that the Apache CXF UsernameTokenPolicyValidator and 
    UsernameTokenInterceptor allow a UsernameToken element with no password child 
    element to bypass authentication. A remote attacker could use this flaw to 
    circumvent access controls applied to web services by omitting the password 
    in a UsernameToken. If an incorrect password is provided, authentication will 
    fail, but if the password is omitted, it will succeed. This flaw is 
    exploitable on web services that rely on WS-SecurityPolicy plaintext 
    UsernameTokens to authenticate users. It is not exploitable when using hashed 
    passwords or WS-Security without WS-SecurityPolicy.
cvss_v2: 6.4
references:
    - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0239
affected:
    - groupId: "org.apache.cxf"
      artifactId: "cxf-rt-ws-security"
      version:
        - "<=2.5.8"
        - "<=2.6.5"
        - "<=2.7.2"
package_urls:
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.9/cxf-rt-ws-security-2.2.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.1/cxf-rt-ws-security-2.4.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.5/cxf-rt-ws-security-2.3.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.5/cxf-rt-ws-security-2.1.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.10/cxf-rt-ws-security-2.0.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.13/cxf-rt-ws-security-2.0.13.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.3/cxf-rt-ws-security-2.4.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.7.0/cxf-rt-ws-security-2.7.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2/cxf-rt-ws-security-2.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.12/cxf-rt-ws-security-2.2.12.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.5/cxf-rt-ws-security-2.2.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.4/cxf-rt-ws-security-2.4.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.9/cxf-rt-ws-security-2.2.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.10/cxf-rt-ws-security-2.4.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.12/cxf-rt-ws-security-2.2.12.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.13/cxf-rt-ws-security-2.0.13.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.10/cxf-rt-ws-security-2.4.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.7.1/cxf-rt-ws-security-2.7.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.3/cxf-rt-ws-security-2.5.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.9/cxf-rt-ws-security-2.3.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.5/cxf-rt-ws-security-2.3.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.6/cxf-rt-ws-security-2.3.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.1/cxf-rt-ws-security-2.4.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.1/cxf-rt-ws-security-2.2.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.2/cxf-rt-ws-security-2.1.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.1/cxf-rt-ws-security-2.1.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.6/cxf-rt-ws-security-2.5.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.5/cxf-rt-ws-security-2.5.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.10/cxf-rt-ws-security-2.3.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.9/cxf-rt-ws-security-2.5.9.jar
    - https://maven.repository.redhat.com/ga/org/apache/cxf/cxf-rt-ws-security/2.4.9-redhat-2/cxf-rt-ws-security-2.4.9-redhat-2.jar
    - https://maven.repository.redhat.com/ga/org/apache/cxf/cxf-rt-ws-security/2.4.6-redhat-1/cxf-rt-ws-security-2.4.6-redhat-1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.7/cxf-rt-ws-security-2.1.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.7/cxf-rt-ws-security-2.4.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.8/cxf-rt-ws-security-2.3.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.3/cxf-rt-ws-security-2.6.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.6/cxf-rt-ws-security-2.3.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.7/cxf-rt-ws-security-2.3.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.4/cxf-rt-ws-security-2.6.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.1/cxf-rt-ws-security-2.6.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.11/cxf-rt-ws-security-2.5.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.0/cxf-rt-ws-security-2.3.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.4/cxf-rt-ws-security-2.5.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.9/cxf-rt-ws-security-2.0.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.2/cxf-rt-ws-security-2.1.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.2/cxf-rt-ws-security-2.6.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.5/cxf-rt-ws-security-2.5.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.5/cxf-rt-ws-security-2.1.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.8/cxf-rt-ws-security-2.1.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.3/cxf-rt-ws-security-2.1.3.jar
    - https://maven.repository.redhat.com/ga/org/apache/cxf/cxf-rt-ws-security/2.4.9-redhat-2/cxf-rt-ws-security-2.4.9-redhat-2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.3/cxf-rt-ws-security-2.4.3.jar
    - https://maven.repository.redhat.com/ga/org/apache/cxf/cxf-rt-ws-security/2.4.6-redhat-1/cxf-rt-ws-security-2.4.6-redhat-1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.0/cxf-rt-ws-security-2.6.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.8/cxf-rt-ws-security-2.3.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2/cxf-rt-ws-security-2.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.11/cxf-rt-ws-security-2.0.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.10/cxf-rt-ws-security-2.1.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.2/cxf-rt-ws-security-2.3.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.8/cxf-rt-ws-security-2.0.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.4/cxf-rt-ws-security-2.4.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.3/cxf-rt-ws-security-2.2.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.10/cxf-rt-ws-security-2.4.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.7/cxf-rt-ws-security-2.2.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.7/cxf-rt-ws-security-2.0.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.3/cxf-rt-ws-security-2.5.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.1/cxf-rt-ws-security-2.5.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.6/cxf-rt-ws-security-2.0.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.10/cxf-rt-ws-security-2.5.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.11/cxf-rt-ws-security-2.5.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.2/cxf-rt-ws-security-2.3.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.12/cxf-rt-ws-security-2.0.12.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.6/cxf-rt-ws-security-2.3.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.2/cxf-rt-ws-security-2.2.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.2/cxf-rt-ws-security-2.1.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.8/cxf-rt-ws-security-2.4.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.5/cxf-rt-ws-security-2.5.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.8/cxf-rt-ws-security-2.5.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.0/cxf-rt-ws-security-2.5.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.4/cxf-rt-ws-security-2.2.4.jar
    - https://maven.repository.redhat.com/ga/org/apache/cxf/cxf-rt-ws-security/2.4.6-redhat-1/cxf-rt-ws-security-2.4.6-redhat-1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.1/cxf-rt-ws-security-2.5.1.jar
    - https://maven.repository.redhat.com/ga/org/apache/cxf/cxf-rt-ws-security/2.4.9-redhat-2/cxf-rt-ws-security-2.4.9-redhat-2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.6/cxf-rt-ws-security-2.2.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.6/cxf-rt-ws-security-2.4.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.7.2/cxf-rt-ws-security-2.7.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.8/cxf-rt-ws-security-2.3.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.4/cxf-rt-ws-security-2.1.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.10/cxf-rt-ws-security-2.2.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.10/cxf-rt-ws-security-2.1.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.2/cxf-rt-ws-security-2.5.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.14/cxf-rt-ws-security-2.6.14.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.7/cxf-rt-ws-security-2.5.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.9/cxf-rt-ws-security-2.4.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.10/cxf-rt-ws-security-2.1.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.11/cxf-rt-ws-security-2.3.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.7/cxf-rt-ws-security-2.2.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.0/cxf-rt-ws-security-2.4.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.5/cxf-rt-ws-security-2.4.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.15/cxf-rt-ws-security-2.6.15.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.12/cxf-rt-ws-security-2.6.12.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.11/cxf-rt-ws-security-2.2.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.1/cxf-rt-ws-security-2.3.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.17/cxf-rt-ws-security-2.6.17.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.4/cxf-rt-ws-security-2.3.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.9/cxf-rt-ws-security-2.1.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.7/cxf-rt-ws-security-2.0.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1/cxf-rt-ws-security-2.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.2/cxf-rt-ws-security-2.4.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.10/cxf-rt-ws-security-2.5.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.8/cxf-rt-ws-security-2.2.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.12/cxf-rt-ws-security-2.0.12.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.3/cxf-rt-ws-security-2.3.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.5/cxf-rt-ws-security-2.6.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.7/cxf-rt-ws-security-2.3.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.2/cxf-rt-ws-security-2.2.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.4/cxf-rt-ws-security-2.5.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.6/cxf-rt-ws-security-2.1.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.6/cxf-rt-ws-security-2.5.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.4/cxf-rt-ws-security-2.5.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.5/cxf-rt-ws-security-2.2.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.8/cxf-rt-ws-security-2.4.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.7/cxf-rt-ws-security-2.3.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.7/cxf-rt-ws-security-2.4.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.0/cxf-rt-ws-security-2.5.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.3/cxf-rt-ws-security-2.3.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.1/cxf-rt-ws-security-2.2.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.11/cxf-rt-ws-security-2.6.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.8/cxf-rt-ws-security-2.2.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.9/cxf-rt-ws-security-2.2.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.5/cxf-rt-ws-security-2.1.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.6/cxf-rt-ws-security-2.4.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1/cxf-rt-ws-security-2.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.5/cxf-rt-ws-security-2.3.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.5/cxf-rt-ws-security-2.4.5.jar
    - https://maven.repository.redhat.com/ga/org/apache/cxf/cxf-rt-ws-security/2.6.8.redhat-7/cxf-rt-ws-security-2.6.8.redhat-7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.4/cxf-rt-ws-security-2.1.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.12/cxf-rt-ws-security-2.2.12.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.1/cxf-rt-ws-security-2.6.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.4/cxf-rt-ws-security-2.3.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.2/cxf-rt-ws-security-2.5.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.0/cxf-rt-ws-security-2.4.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.9/cxf-rt-ws-security-2.4.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.13/cxf-rt-ws-security-2.0.13.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.11/cxf-rt-ws-security-2.0.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.11/cxf-rt-ws-security-2.3.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.9/cxf-rt-ws-security-2.3.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.7/cxf-rt-ws-security-2.5.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.1/cxf-rt-ws-security-2.4.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2/cxf-rt-ws-security-2.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.7/cxf-rt-ws-security-2.1.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.8/cxf-rt-ws-security-2.5.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.11/cxf-rt-ws-security-2.2.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.1/cxf-rt-ws-security-2.3.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.10/cxf-rt-ws-security-2.3.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.10/cxf-rt-ws-security-2.2.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.9/cxf-rt-ws-security-2.1.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.6/cxf-rt-ws-security-2.2.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.2/cxf-rt-ws-security-2.6.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.4/cxf-rt-ws-security-2.2.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.2/cxf-rt-ws-security-2.4.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.10/cxf-rt-ws-security-2.0.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.16/cxf-rt-ws-security-2.6.16.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.1/cxf-rt-ws-security-2.1.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.6/cxf-rt-ws-security-2.0.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.5/cxf-rt-ws-security-2.6.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.9/cxf-rt-ws-security-2.0.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.0/cxf-rt-ws-security-2.3.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.6/cxf-rt-ws-security-2.1.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.3/cxf-rt-ws-security-2.1.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.3/cxf-rt-ws-security-2.4.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.8/cxf-rt-ws-security-2.1.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.2/cxf-rt-ws-security-2.3.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.13/cxf-rt-ws-security-2.6.13.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.8/cxf-rt-ws-security-2.6.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.8/cxf-rt-ws-security-2.0.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.5/cxf-rt-ws-security-2.2.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.3/cxf-rt-ws-security-2.2.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.4/cxf-rt-ws-security-2.4.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.1/cxf-rt-ws-security-2.5.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.3/cxf-rt-ws-security-2.2.3.jar
    - https://maven.repository.redhat.com/ga/org/apache/cxf/cxf-rt-ws-security/2.6.6-redhat-3/cxf-rt-ws-security-2.6.6-redhat-3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.11/cxf-rt-ws-security-2.2.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.3/cxf-rt-ws-security-2.3.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.7/cxf-rt-ws-security-2.2.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.7/cxf-rt-ws-security-2.6.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.4/cxf-rt-ws-security-2.1.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.8/cxf-rt-ws-security-2.2.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.7/cxf-rt-ws-security-2.0.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.7/cxf-rt-ws-security-2.4.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.8/cxf-rt-ws-security-2.0.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1/cxf-rt-ws-security-2.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.8/cxf-rt-ws-security-2.1.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.5/cxf-rt-ws-security-2.4.5.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.2/cxf-rt-ws-security-2.4.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.4/cxf-rt-ws-security-2.3.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.3/cxf-rt-ws-security-2.5.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.9/cxf-rt-ws-security-2.6.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.0/cxf-rt-ws-security-2.6.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.0/cxf-rt-ws-security-2.4.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.1/cxf-rt-ws-security-2.3.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.10/cxf-rt-ws-security-2.6.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.11/cxf-rt-ws-security-2.0.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.2/cxf-rt-ws-security-2.2.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.7/cxf-rt-ws-security-2.5.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.3/cxf-rt-ws-security-2.1.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.3/cxf-rt-ws-security-2.6.3.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.8/cxf-rt-ws-security-2.5.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.6/cxf-rt-ws-security-2.1.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.9/cxf-rt-ws-security-2.4.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.9/cxf-rt-ws-security-2.0.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.10/cxf-rt-ws-security-2.2.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.6/cxf-rt-ws-security-2.2.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.1/cxf-rt-ws-security-2.1.1.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.6/cxf-rt-ws-security-2.4.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.4/cxf-rt-ws-security-2.6.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.4/cxf-rt-ws-security-2.2.4.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.12/cxf-rt-ws-security-2.0.12.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.4.8/cxf-rt-ws-security-2.4.8.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.10/cxf-rt-ws-security-2.0.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.0.6/cxf-rt-ws-security-2.0.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.2/cxf-rt-ws-security-2.5.2.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.7/cxf-rt-ws-security-2.1.7.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.6.6/cxf-rt-ws-security-2.6.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.1.9/cxf-rt-ws-security-2.1.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.9/cxf-rt-ws-security-2.5.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.11/cxf-rt-ws-security-2.3.11.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.10/cxf-rt-ws-security-2.3.10.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.0/cxf-rt-ws-security-2.3.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.6/cxf-rt-ws-security-2.5.6.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.5.0/cxf-rt-ws-security-2.5.0.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.3.9/cxf-rt-ws-security-2.3.9.jar
    - http://central.maven.org/maven2/org/apache/cxf/cxf-rt-ws-security/2.2.1/cxf-rt-ws-security-2.2.1.jar
