Lucene search

[email protected]NVD:CVE-2019-12406

HistoryNov 06, 2019 - 9:15 p.m.

CVE-2019-12406

2019-11-0621:15:11

CWE-770

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.016

Percentile

87.4%

JSON

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property “attachment-max-count”.

Affected configurations

Nvd

Node

apachecxfRange<3.2.11

apachecxfRange3.3.0–3.3.4

Node

oraclecommerce_guided_searchMatch11.3.2

oracleflexcube_private_bankingMatch12.0.0

oracleflexcube_private_bankingMatch12.1.0

oracleretail_order_brokerMatch15.0

VendorProductVersionCPE
apachecxf*cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
oraclecommerce_guided_search11.3.2cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*
oracleflexcube_private_banking12.0.0cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
oracleflexcube_private_banking12.1.0cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
oracleretail_order_broker15.0cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	cxf	*	cpe:2.3:a:apache:cxf::::::::
oracle	commerce_guided_search	11.3.2	cpe:2.3:a:oracle:commerce_guided_search:11.3.2:::::::*
oracle	flexcube_private_banking	12.0.0	cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:::::::*
oracle	flexcube_private_banking	12.1.0	cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:::::::*
oracle	retail_order_broker	15.0	cpe:2.3:a:oracle:retail_order_broker:15.0:::::::*