PT-2017-5069 · Apache · Apache Cxf

Published

2017-08-08

·

Updated

2023-02-13

·

CVE-2012-0803

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Apache CXF versions 2.4.5 through 2.5.1
Description: The issue allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request, specifically exploiting the WS-SP UsernameToken policy.
Recommendations: For Apache CXF versions 2.4.5 and 2.5.1, consider disabling the WS-SP UsernameToken policy until a patch is available to prevent authentication bypass.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-0803
GHSA-2P7X-JCR3-7P2C

Affected Products

Apache Cxf