CVE-2010-2076

🗓️ 19 Aug 2010 17:43:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 113 Views🌐 WEB

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9 does not properly reject DTDs in SOAP messages, leading to remote attacks and denial of service

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2010-2076	15 Feb 202423:16	–	circl
Cvelist	CVE-2010-2076	19 Aug 201017:43	–	cvelist
F5 Networks	K15580: Apache CXF and JBoss vulnerabilities	21 Feb 202319:49	–	f5
F5 Networks	SOL15580 - Apache CXF and JBoss vulnerabilities	11 Sep 201400:00	–	f5
Github Security Blog	Improper Input Validation in Apache CXF	13 May 202201:09	–	github
Mend	CVE-2010-2076	19 Aug 201017:43	–	mend
NVD	CVE-2010-2076	19 Aug 201018:00	–	nvd
OSV	GHSA-V8Q2-94F6-6XQ2 Improper Input Validation in Apache CXF	13 May 202201:09	–	osv
Prion	Design/Logic Flaw	19 Aug 201018:00	–	prion
Positive Technologies	PT-2010-3687 · Apache · Apache Cxf	19 Aug 201000:00	–	ptsecurity

NVD

Node

apache cxfRange2.0.6–2.0.13

apache cxfRange2.1–2.1.10

apache cxfRange2.2.0–2.2.9

Source	Link
issues	www.issues.apache.org/jira/browse/GERONIMO-5383
geronimo	www.geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
lists	www.lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
secunia	www.secunia.com/advisories/41016
geronimo	www.geronimo.apache.org/21x-security-report.html
svn	www.svn.apache.org/repos/asf/cxf/trunk/security/CVE-2010-2076.pdf
lists	www.lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
securityfocus	www.securityfocus.com/bid/42492
geronimo	www.geronimo.apache.org/22x-security-report.html
secunia	www.secunia.com/advisories/40969

Parameter	Position	Path	Description	CWE
DOCTYPE	request body	samples/wsdl_first_pure_xml	DTD-based XML External Entity (XXE) vulnerability in Apache CXF allowing remote file read, SSRF, or DoS via a crafted DTD in a SOAP request.	CWE-829
ENTITY	request body	samples/wsdl_first_pure_xml	DTD-based XML External Entity (XXE) vulnerability in Apache CXF allowing remote file read, SSRF, or DoS via a crafted DTD in a SOAP request.	CWE-829
external entity	request body	samples/wsdl_first_pure_xml	DTD-based XML External Entity (XXE) vulnerability in Apache CXF allowing remote file read, SSRF, or DoS via a crafted DTD in a SOAP request.	CWE-829
XML External Entity (XXE) payload	request body	samples/wsdl_first_pure_xml	DTD-based XML External Entity (XXE) vulnerability in Apache CXF allowing remote file read, SSRF, or DoS via a crafted DTD in a SOAP request.	CWE-829

16 Jun 2026 23:19Current

9.1Critical risk

Vulners AI Score9.1

CVSS 27.5

CVSS 3.19.8

EPSS0.09788

CWE-829