Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 86

Export CSV
CVE-2014-0035

CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS 2.0 · 4.3 Medium EPSS 7.1% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0034

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

CVSS 2.0 · 4.3 Medium EPSS 7.4% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2015-5253

apache-cxf: SAML SSO processing is vulnerable to wrapping attack

The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."

CVSS 2.0 · 4.0 Medium EPSS 5.7% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Fuse
CVE-2013-2160

apache-cxf: Multiple denial of service flaws in the StAX parser

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

CVSS 2.0 · 5.0 Medium EPSS 32.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Portal Platform and 1 more
CVE-2012-2378

apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side

Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.

CVSS 2.0 · 4.3 Medium EPSS 3.9% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Enterprise Application Platform
CVE-2012-2379

apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.

CVSS 2.0 · 10.0 Critical EPSS 4.1% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Enterprise Application Platform Jboss Enterprise Brms Platform and 2 more
CVE-2012-3451

apache-cxf: SOAPAction spoofing on document literal web services

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.

CVSS 2.0 · 4.3 Medium EPSS 8.9% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Enterprise Application Platform Jboss Enterprise Brms Platform and 2 more
CVE-2012-5575

apache-cxf: XML encryption backwards compatibility attacks

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

CVSS 2.0 · 6.4 Medium EPSS 6.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Application Platform and 5 more
CVE-2012-5633

apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.

CVSS 2.0 · 5.8 Medium EPSS 8.2% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Application Platform and 4 more
CVE-2012-5786

cxf: Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate

The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. NOTE: The vendor states that the sample had specifically used a flag to bypass the DN check

CVSS 2.0 · 5.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Apache
Products
Cxf
CVE-2013-0239

apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

CVSS 2.0 · 5.0 Medium EPSS 4.7% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Application Platform and 1 more
CVE-2010-2076

CXF: Insufficient constraints on Document Type Declarations (DTDs)

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.

CVSS 3.1 · 9.8 Critical EPSS 9.8% KEV · Not listed
Vendors
Apache
Products
Cxf
CVE-2021-22696

OAuth 2 authorization service vulnerable to DDos attacks

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Cxf Business Intelligence Communications Diameter Intelligence Hub and 5 more
CVE-2020-13954

Apache CXF Reflected XSS in the services listing page via the styleSheetPath

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.

CVSS 3.1 · 6.1 Medium EPSS 40.9% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Cxf Snap Creator Framework Vasa Provider For Clustered Data Ontap and 5 more
CVE-2024-41172

Apache CXF: Unrestricted memory consumption in CXF HTTP clients

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Camel Quarkus Jboss Enterprise Application Platform
CVE-2024-32007

Apache CXF Denial of Service vulnerability in JOSE

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. 

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Apache-camel-spring-boot Apache Camel Spring Boot and 1 more
CVE-2024-29736

Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Apache-camel-spring-boot Apache Camel Spring Boot
CVE-2021-30468

Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.

CVSS 3.1 · 7.5 High EPSS 7.0% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Cxf Tomee Business Intelligence and 5 more
CVE-2020-1954

cxf: JMX integration is vulnerable to a MITM attack

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.

CVSS 3.1 · 5.3 Medium EPSS 6.1% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Cxf Oncommand Workflow Automation Snapmanager and 12 more
CVE-2019-17573

cxf: reflected XSS in the services listing page

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.

CVSS 3.1 · 6.1 Medium EPSS 7.1% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Cxf Commerce Guided Search Communications Element Manager and 11 more