CVEvulnerability

CVE-2025-48913

9.8 CRITICAL Published 2025-08-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2025-08-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20

Description

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.

Affected configurations

• apache cxf (< 3.6.8) • apache cxf (>= 4.0.0 < 4.0.9) • apache cxf (>= 4.1.0 < 4.1.3)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References