With a bit of digging around, I've found some evidence of recent activity on this subject: Functional Explanation of Changes in XML Encryption 1.1 (W3C Working Group Note 11 April 2013). There are a lot of changes in the XML Encryption 1.1, among others:
- Added Key Derivation
- Added Elliptic Curve Diffie-Hellman Key Agreement
- Added Algorithms
- Changed Algorithms
and among most relevant to your question, changes to security considerations:
Added security consideration information on Chosen Ciphertext Attacks, including attacks against encrypted data and encrypted key. Provide specific notes on CBC Block Encryption vulnerability, and the Bleichenbacher attack.
The article you were reading is about exploiting a weakness in the CBC mode for the chaining of different ciphertext blocks. While it does appear to be the real thing, it applies to encryption schemes before XML Encryption 1.1:
“We were able to decrypt data by sending modified ciphertexts to the
server, by gathering information from the received error messages.”
The attack was tested against a popular open source implementation of
XML Encryption, and against the implementations of companies that
responded to the responsible disclosure – in all cases the result was
the same: the attack works, XML Encryption is not secure.
While I don't see this as exaggeration, and it doesn't strike me as surprising either (see for example this answer to the question How less secure is an encryption if we know something about the original data? and Wiki on Adaptive chosen-ciphertext attack), it needs to be mentioned again that it applies to CBC encryption mode avalable in XML Encryption 1.0 that was handled by a different W3C workgroup (XML Encryption WG last active in 2008).
This work has by now been moved to XML Security Working Group whose baby is XML Encryption 1.1 as a direct answer to such attacks as described in the article. In fact, The XML Security Working Group even directly mentions these attacks on XML Encryption 1.0 in the XML Encryption 1.1 documentation.
Addendum: Whilst reading through some non-related cryptography articles, I've stumbled across Matthew Green's blog post on Attack of the week: XML Encryption dating back to October, 2011. Matthew Green is a cryptographer and research professor at Johns Hopkins University, and writes most fabulous texts on cryptography and related subjects. His explanation of what this attack on XML Encryption is all about is the best one I've yet read, and of course a recommended read for anyone interested to learn more about them. Here's a short excerpt:
Stop using unauthenticated CBC mode. Stop using any encryption
standard designed before 2003 that hasn't been carefully analyzed and
recently updated. Stop using any unauthenticated encryption at all.
Wrap your SOAP connections with TLS (a recent version!) if you can.
Source: Attack of the week: XML Encryption, Matthew Green