PT-2010-3687 · Apache · Apache Cxf

Published 2010-08-19 · Updated 2024-02-15 · CVE-2010-2076

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache CXF versions 2.0.x through 2.0.12 Apache CXF versions 2.1.x through 2.1.9 Apache CXF versions 2.2.x through 2.2.8

Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via a crafted DTD in SOAP messages. This is due to the improper rejection of DTDs in SOAP messages.

Recommendations For Apache CXF versions 2.0.x through 2.0.12, update to version 2.0.13 or later. For Apache CXF versions 2.1.x through 2.1.9, update to version 2.1.10 or later. For Apache CXF versions 2.2.x through 2.2.8, update to version 2.2.9 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-829

CWE-20

Related Identifiers

CVE-2010-2076

GHSA-V8Q2-94F6-6XQ2

Affected Products

Apache Cxf

References · 25

• 🔥 http://svn.apache.org/repos/asf/cxf/trunk/security/CVE-2010-2076.pdf · Exploit
• http://secunia.com/advisories/41016 · Vendor Advisory
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Patch
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E · Patch
• https://osv.dev/vulnerability/GHSA-v8q2-94f6-6xq2 · Vendor Advisory
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Patch
• http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html · Vendor Advisory
• https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E · Patch
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E · Patch
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E · Patch
• http://secunia.com/advisories/41025 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2076 · Security Note
• http://geronimo.apache.org/22x-security-report.html · Vendor Advisory
• http://secunia.com/advisories/40969 · Vendor Advisory
• http://geronimo.apache.org/21x-security-report.html · Vendor Advisory