Denial Of Service (DoS)

2024-07-2113:53:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

dos

apache cxf

pbes2 count

size restrictions

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

JSON

org.apache.cxf: cxf-rt-rs-security-jose is vulnerable to Denial Of Service (DoS). The vulnerability is due to missing size restrictions in the p2c (PBES2 count) parameter, which allows an attacker to perform a Denial Of Service attack by specifying a large value for this parameter in a token.