GitHub Advisoryadvisory · Maven

GHSA-254q-rp36-v2m8 Missing XML Validation in Apache CXF

MEDIUM Published 2022-05-13 Modified 2022-07-08 Official page ↗
Aliases
CVE-2013-2160
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-frontend-jaxrs
Severity
Moderate
Weaknesses
CWE-112
Reviewed
2022-07-08

Affected packages

• Maven org.apache.cxf:cxf-rt-frontend-jaxrs: >= 2.5.0, < 2.5.10 → fixed in 2.5.10 • Maven org.apache.cxf:cxf-rt-frontend-jaxrs: >= 2.6.0, < 2.6.7 → fixed in 2.6.7 • Maven org.apache.cxf:cxf-rt-frontend-jaxrs: >= 2.7.0, < 2.7.4 → fixed in 2.7.4

Description

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

Related

Alias · CVE (1)

  • CVE-2013-2160 The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a… vulnerability

Weakness · CWE (1)

  • CWE-112 Missing XML Validation weakness

References