GitHub Advisoryadvisory · Maven

GHSA-xf9f-32gh-h2w4 Improper Authentication in Apache CXF

MEDIUM Published 2022-05-13 Modified 2023-12-21 Official page ↗
Aliases
CVE-2012-5633
Ecosystem
Maven
Packages
org.apache.cxf:cxf
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2022-07-13

Affected packages

• Maven org.apache.cxf:cxf: < 2.5.8 → fixed in 2.5.8 • Maven org.apache.cxf:cxf: >= 2.6.0, < 2.6.5 → fixed in 2.6.5 • Maven org.apache.cxf:cxf: >= 2.7.0, < 2.7.2 → fixed in 2.7.2

Description

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.

Related

Alias · CVE (1)

  • CVE-2012-5633 The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor,… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References