CVE-2019-12406

🗓️ 06 Nov 2019 20:07:27Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 215 Views

Apache CXF allows unlimited message attachments pre 3.3.4, leading to potential denial of service. From 3.3.4 & 3.2.11, limit of 50 attachments is enforced. Configurable via "attachment-max-count"

Reporter	Title	Published	Views	Family All 80
IBM Security Bulletins	Security Bulletin: Vulnerabilities in IBM WebSphere Liberty affects IBM Waston Machine Learning Accelerator	18 Jan 202107:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in WebSphere Application Server Liberty affect DOORS Next Generation (DNG/RRC)	24 Feb 202015:20	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Digital Business Automation Workflow family products (CVE-2019-12406)	14 Sep 202215:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2019-12406)	27 May 202008:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	7 Oct 202020:49	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache CXF affects WebSphere Application Server shipped with IBM® Intelligent Operations Center (CVE-2019-12406)	4 Mar 202017:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in WebSphere Application Server bundled with IBM WebSphere Application Server Patterns	6 Feb 202016:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	29 Apr 202502:26	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Asset Analyzer is affected by a vulnerability in Websphere Application Server.	30 Jun 202020:14	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in WebSphere Application Server shipped with Cloud Pak System (CVE-2019-12406)	7 Jul 202013:14	–	ibm

NVD

Vulners

Node

apache cxfRange<3.2.11

apache cxfRange3.3.0–3.3.4

Node

oracle commerce_guided_searchMatch11.3.2

oracle flexcube_private_bankingMatch12.0.0

oracle flexcube_private_bankingMatch12.1.0

oracle retail_order_brokerMatch15.0

[
  {
    "product": "Apache CXF",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Apache CXF versions before 3.3.4 and 3.2.11"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
lists	www.lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
lists	www.lists.apache.org/thread.html/rca465c9d1e1969281338522b76701c85a07abd045c494261137236e0%40%3Cissues.cxf.apache.org%3E
cxf	www.cxf.apache.org/security-advisories.data/CVE-2019-12406.txt.asc
lists	www.lists.apache.org/thread.html/rabc395b38acb7f2465bfbf0bc16d6e1e95720c89bea87abe8808eeea%40%3Cissues.cxf.apache.org%3E
oracle	www.oracle.com/security-alerts/cpujan2020.html
oracle	www.oracle.com/security-alerts/cpuApr2021.html
lists	www.lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
lists	www.lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
lists	www.lists.apache.org/thread.html/rb2a6dab1f781f55326543c56dc29ea677759439ddfeba920c83037e6%40%3Cissues.cxf.apache.org%3E

21 Nov 2024 04:22Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.3

CVSS 3.16.5

EPSS0.04134

CWE-770