Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Improper Neutralization of Input During Web Page Generation in Apache CXF

🗓️ 13 May 2022 01:09:20Reported by GitHub Advisory DatabaseType 
github
 github🔗 github.com👁 22 Views

Improper Neutralization of Input During Web Page Generation in Apache CXF. HTTP transport module in Apache CXF uses FormattedServiceLIstWriter to provide a page listing available service endpoints. Base URL calculation using current HttpServletRequest can lead to XSS risk if unexpected matrix parameters are injected into request URL

Related
Detection
Refs
ReporterTitlePublishedViews
Family
IBM Security Bulletins		Security Bulletin: Security vulnerabilities have been identified in the Apache CXF component of IBM Tivoli Network Manager IP Edition (CVE-2016-6812, CVE-2016-8739)
17 Jun 201815:40
–ibm
IBM Security Bulletins		Security Bulletin: Mulitiple security vulnerabilities in Apache CXF affects IBM InfoSphere Master Data Management (CVE-2016-6812 CVE-2016-8739 CVE-2017-5653 CVE-2017-5656 CVE-2017-3156)
16 Jun 201814:18
–ibm
IBM Security Bulletins		Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities
27 May 202008:29
–ibm
IBM Security Bulletins		Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerability
19 Jul 201916:20
–ibm
IBM Security Bulletins		Security Bulletin: Vulnerabilities found in cxf-rt-transports-http-3.0.3.jar which is shipped with IBM® Intelligent Operations Center(CVE-2016-6812, CVE-2018-8039, CVE-2020-13954)
5 Sep 202312:31
–ibm
Circl		CVE-2016-6812
18 Aug 202521:02
–circl
CNVD		Apache CXF Cross-Site Scripting Vulnerability
25 Apr 201700:00
–cnvd
CVE		CVE-2016-6812
10 Aug 201716:00
–cve
Cvelist		CVE-2016-6812
10 Aug 201716:00
–cvelist
EUVD		EUVD-2022-5439
3 Oct 202520:07
–euvd
Rows per page
Vulners
Node
org.apache.cxfcxf-coreRange3.1.0–3.1.8maven
OR
org.apache.cxfcxf-coreRange≤3.0.11maven
SourceLink
nvdwww.nvd.nist.gov/vuln/detail/CVE-2016-6812
accesswww.access.redhat.com/errata/RHSA-2017:0868
issueswww.issues.apache.org/jira/browse/CXF-6216
listswww.lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
listswww.lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
listswww.lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
listswww.lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
listswww.lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
listswww.lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
cxfwww.cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
21 Dec 2023 22:53Current
0.9Low risk
Vulners AI Score0.9
CVSS 24.3
CVSS 36.1
EPSS0.09833
CWE-79
apache cxfhttp transport moduleformattedservicelistwriterxss risk
22