CVE-2014-0109

2014-05-0814:29:00

CWE-399

[email protected]

web.nvd.nist.gov

cve-2014-0109

apache cxf

denial of service

memory consumption

nvd

8.7 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.009 Low

EPSS

Percentile

82.2%

JSON

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.

CPENameOperatorVersion
apache:cxfapache cxfeq2.7.3
apache:cxfapache cxfeq2.7.5
apache:cxfapache cxfeq2.7.10
apache:cxfapache cxfeq2.7.6
apache:cxfapache cxfeq2.7.9
apache:cxfapache cxfeq2.7.0
apache:cxfapache cxfeq2.7.4
apache:cxfapache cxfeq2.7.1
apache:cxfapache cxfeq2.7.8
apache:cxfapache cxfeq2.7.7

CPE	Name	Operator	Version
apache:cxf	apache cxf	eq	2.7.3
apache:cxf	apache cxf	eq	2.7.5
apache:cxf	apache cxf	eq	2.7.10
apache:cxf	apache cxf	eq	2.7.6
apache:cxf	apache cxf	eq	2.7.9
apache:cxf	apache cxf	eq	2.7.0
apache:cxf	apache cxf	eq	2.7.4
apache:cxf	apache cxf	eq	2.7.1
apache:cxf	apache cxf	eq	2.7.8
apache:cxf	apache cxf	eq	2.7.7