GHSA-xf9f-32gh-h2w4Medium

Improper Authentication in Apache CXF

Published
May 13, 2022
Last Modified
December 21, 2023

🔗 CVE IDs covered (1)

CVE-2012-5633 →

📋 Description

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.

🎯 Affected products3

  • maven/org.apache.cxf:cxf:< 2.5.8
  • maven/org.apache.cxf:cxf:>= 2.6.0, < 2.6.5
  • maven/org.apache.cxf:cxf:>= 2.7.0, < 2.7.2

🔗 References (38)