CVEvulnerability

CVE-2012-2379

10.0 HIGH Published 2013-01-03 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-01-03
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.

Affected configurations

• apache cxf 2.4.0 • apache cxf 2.4.1 • apache cxf 2.4.2 • apache cxf 2.4.3 • apache cxf 2.4.4 • apache cxf 2.4.5 • apache cxf 2.4.6 • apache cxf 2.4.7 • apache cxf 2.5.0 • apache cxf 2.5.1 • apache cxf 2.5.2 • apache cxf 2.5.3 • apache cxf 2.6.0

References