Product:

Cxf

(Apache)
Repositories https://github.com/apache/cxf
#Vulnerabilities 36
Date Id Summary Products Score Patch Annotated
2020-01-16 CVE-2019-17573 By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable. Cxf, Commerce_guided_search, Communications_element_manager, Communications_session_report_manager, Communications_session_route_manager, Flexcube_private_banking, Retail_order_broker 6.1
2020-04-01 CVE-2020-1954 Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is... Cxf, Oncommand_workflow_automation, Snapmanager, Communications_diameter_signaling_router, Communications_diameter_signaling_router_idih\:, Communications_element_manager, Communications_session_report_manager, Communications_session_route_manager, Enterprise_manager_base_platform, Peoplesoft_enterprise_peopletools 5.3
2020-11-12 CVE-2020-13954 By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573. Cxf, Snap_creator_framework, Vasa_provider_for_clustered_data_ontap, Business_intelligence, Communications_messaging_server, Retail_order_broker_cloud_service 6.1
2021-04-02 CVE-2021-22696 CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the... Cxf, Business_intelligence, Communications_diameter_intelligence_hub, Communications_element_manager, Communications_session_report_manager, Communications_session_route_manager 7.5
2021-06-16 CVE-2021-30468 A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11. Cxf, Tomee, Business_intelligence, Communications_element_manager, Communications_messaging_server 7.5
2021-09-19 CVE-2021-40690 All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element. Cxf, Santuario_xml_security_for_java, Tomee, Debian_linux, Agile_plm, Commerce_guided_search, Commerce_platform, Communications_diameter_intelligence_hub, Communications_messaging_server, Flexcube_private_banking, Outside_in_technology, Peoplesoft_enterprise_peopletools, Retail_bulk_data_integration, Retail_financial_integration, Retail_integration_bus, Retail_merchandising_system, Retail_service_backbone, Weblogic_server 7.5
2022-12-13 CVE-2022-46363 A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured. Cxf 7.5
2022-12-13 CVE-2022-46364 A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.  Cxf 9.8
2012-09-24 CVE-2012-3451 Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body. Cxf N/A
2013-01-03 CVE-2012-2379 Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors. Cxf N/A