CVE-2022-1279: Insecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloads

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-14 · updated 2026-06-17
Weakness: CWE-325

Description

A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt EBICS payloads. This issue affects: ebics-java/ebics-java-client versions prior to 1.2.

Affected products

ebics-java-client: before 1.2 — fixed in 1.2

How to fix

Upgrade to a fixed version: ebics-java-client 1.2. Check the vendor advisory for mitigations.

References

https://github.com/ebics-java/ebics-java-client/releases/tag/1.2
https://github.com/ebics-java/ebics-java-client/releases/tag/1.2

Get alerted when CVE-2022-1279 or the next vulnerability affects your stack