Cxf@3.0.0 Security Vulnerabilities and Issues — Cxf@3.0.0 CVE List

Lucene search

ApacheCxf3.0.0

3 matches found

CVE•added 2017/11/14 4:29 p.m.•120 views

CVE-2017-12624

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack....

5.5CVSS5.4AI score0.02512EPSS

CVE•added 2017/04/18 4:59 p.m.•95 views

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

5.3CVSS5.4AI score0.03167EPSS

CVE•added 2017/04/18 4:59 p.m.•85 views

CVE-2017-5656

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

7.5CVSS7.3AI score0.03801EPSS