PT-2013-2181 · Apache · Apache Cxf

Colm O Heigeartaigh · Published 2013-03-12 · Updated 2023-02-13 · CVE-2013-0239

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions 2.5.0 through 2.5.9 Apache CXF versions 2.6.0 through 2.6.6 Apache CXF versions 2.7.0 through 2.7.3

Description The issue allows remote attackers to bypass authentication when the plaintext UsernameToken WS-SecurityPolicy is enabled. This occurs via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

Recommendations For Apache CXF versions 2.5.0 through 2.5.9, update to version 2.5.9 or later. For Apache CXF versions 2.6.0 through 2.6.6, update to version 2.6.6 or later. For Apache CXF versions 2.7.0 through 2.7.3, update to version 2.7.3 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-0239

GHSA-P5C5-6564-VVR8

RHSA-2013:0644

Affected Products

Apache Cxf

References · 26

• http://rhn.redhat.com/errata/RHSA-2013-0749.html · Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=1438424 · Patch
• https://osv.dev/vulnerability/GHSA-p5c5-6564-vvr8 · Vendor Advisory
• http://secunia.com/advisories/51988 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0239 · Security Note
• http://cxf.apache.org/cve-2013-0239.html · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://github.com/apache/cxf/commit/e4c6b3b0899ef2ba87c2610efc323b71c13dd421 · Note
• https://web.archive.org/web/20200229102616/http://securityfocus.com/bid/57876 · Note
• http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html · Note
• http://securityfocus.com/bid/57876 · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E · Note