PT-2013-1817 · Apache · Apache Cxf

Published 2013-03-12 · Updated 2023-02-13 · CVE-2012-5633

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions 2.5.0 through 2.5.7 Apache CXF versions 2.6.0 through 2.6.4 Apache CXF versions 2.7.0 through 2.7.1

Description The issue allows remote attackers to obtain access to SOAP services via an HTTP GET request, bypassing WS-Security processing when using the WSS4JInInterceptor.

Recommendations For Apache CXF versions 2.5.0 through 2.5.7, update to version 2.5.8 or later. For Apache CXF versions 2.6.0 through 2.6.4, update to version 2.6.5 or later. For Apache CXF versions 2.7.0 through 2.7.1, update to version 2.7.2 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-5633

GHSA-XF9F-32GH-H2W4

RHSA-2013:0257

RHSA-2013:0259

RHSA-2013:0644

Affected Products

Apache Cxf

References · 43

• http://rhn.redhat.com/errata/RHSA-2013-0726.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0259.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0749.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0258.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5633 · Security Note
• https://osv.dev/vulnerability/GHSA-xf9f-32gh-h2w4 · Vendor Advisory
• http://secunia.com/advisories/52183 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0256.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0257.html · Vendor Advisory
• http://cxf.apache.org/cve-2012-5633.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0743.html · Vendor Advisory
• http://secunia.com/advisories/51988 · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://github.com/apache/cxf/commit/0cbc56618b6048847debe670d54919e227744401 · Note
• https://github.com/apache/cxf/commit/d99f96aa970d9f2faa8ed45e278a403af48757ae · Note