GHSA-ffm7-7r8g-77xm Apache CXF JMX Integration is vulnerable to a MITM attack

• Maven org.apache.cxf:cxf-rt-management: < 3.2.13 → fixed in 3.2.13 • Maven org.apache.cxf:cxf-rt-management: >= 3.3.0, < 3.3.6 → fixed in 3.3.6

Apache CXF has the ability to integrate with JMX by registering an `InstrumentationManager` extension with the CXF bus. If the `createMBServerConnectorFactory` property of the default `InstrumentationManagerImpl` is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.