The vulnerability arises because Wss4jSecurityInterceptor initializes its BSP compliance flag such that inbound validation disables enforcement of WS-I Basic Security Profile rules on RequestData. This misconfiguration allows WS-Security validating services to accept messages that do not comply with BSP rules, thereby weakening protocol-level security enforcement. Affected versions include Spring Web Services 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1. The CVSS 3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. No official patch or remediation level is provided in the available data.

The vulnerability allows attackers to send WS-Security messages that violate WS-I Basic Security Profile rules but are still accepted by affected services. This weakens protocol-level security checks, potentially allowing integrity violations in message processing. The confidentiality impact is low, integrity impact is high, and availability is not affected. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Spring's official advisories for updates. Until a fix is available, consider additional validation controls outside of Wss4jSecurityInterceptor to enforce BSP compliance if feasible.