The vulnerability arises because the Wss4jSecurityInterceptor in Spring Web Services defaults the allowRSA15KeyTransportAlgorithm flag to true, which permits the use of the RSA PKCS#1 v1.5 key transport algorithm for WS-Security decryption. This behavior overrides the safer default setting in Apache WSS4J, potentially allowing weaker cryptographic protections unless the flag is explicitly disabled by operators. The affected versions span multiple major releases of Spring Web Services, specifically 3.1.0 to 3.1.8, 4.0.0 to 4.0.18, 4.1.0 to 4.1.3, and 5.0.0 to 5.0.1. No official patch or remediation level has been published as of the data provided.

The use of the RSA PKCS#1 v1.5 key transport algorithm, which is considered broken or risky, can weaken the cryptographic security of WS-Security inbound message decryption. This may lead to potential confidentiality and integrity issues in the affected Spring Web Services implementations. The CVSS score of 4.8 reflects a medium severity impact with network attack vector, high attack complexity, no privileges required, no user interaction, and low confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Operators should explicitly reconfigure the allowRSA15KeyTransportAlgorithm flag to false to avoid accepting RSA PKCS#1 v1.5 encrypted key material. Monitoring vendor communications for an official fix or update is recommended.