PT-2017-9025 · Apache · Apache Cxf

Donald Kwakkel · Publicado 2017-08-10 · Atualizado 2022-05-13 · CVE-2016-6812

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.0.12 Apache CXF versions 3.1.x prior to 3.1.9

Description The issue concerns the HTTP transport module, which generates an HTML page listing available service endpoints. This page includes the names and absolute URL addresses of these endpoints. The module calculates the base URL from the current HttpServletRequest. If unexpected matrix parameters are injected into the request URL, they can be reflected back to the client in the services list page, posing a risk of cross-site scripting (XSS) to the client.

Recommendations For Apache CXF versions prior to 3.0.12, update to version 3.0.12 or later. For Apache CXF versions 3.1.x prior to 3.1.9, update to version 3.1.9 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-6812

GHSA-VW2C-5WPH-V92R

Produtos afetados

Apache Cxf

Referências · 25

• https://github.com/apache/cxf · Nota
• https://github.com/apache/cxf/commit/1be97cb13aef121b799b1be4d9793c0e8b925a12 · Nota
• https://github.com/apache/cxf/commit/1f824d8039c7a42a4aa46f844e6c800e1143c7e7 · Nota
• https://github.com/apache/cxf/commit/32e89366e2daa5670ac7a5c5c19f0bf9329a4c1e · Nota
• https://github.com/apache/cxf/commit/a30397b0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6812 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vw2c-5wph-v92r · Aviso do Fabricante
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E · Nota
• https://access.redhat.com/errata/RHSA-2017:0868 · Aviso do Fabricante
• https://issues.apache.org/jira/browse/CXF-6216 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E · Nota
• http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-6812 · Aviso do Fabricante
• http://securityfocus.com/bid/97582 · Nota