GitHub Advisoryadvisory · Maven

GHSA-p5c5-6564-vvr8 Improper Authentication in Apache CXF

MEDIUM Published 2022-05-05 Modified 2023-12-21 Official page ↗
Aliases
CVE-2013-0239
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-frontend-jaxrs
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2022-07-08

Affected packages

• Maven org.apache.cxf:cxf-rt-frontend-jaxrs: < 2.5.9 → fixed in 2.5.9 • Maven org.apache.cxf:cxf-rt-frontend-jaxrs: >= 2.6.0, < 2.6.6 → fixed in 2.6.6 • Maven org.apache.cxf:cxf-rt-frontend-jaxrs: >= 2.7.0, < 2.7.3 → fixed in 2.7.3

Description

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

Related

Alias · CVE (1)

  • CVE-2013-0239 Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References