GHSA-2p7x-jcr3-7p2cCriticalCVSS 9.8

Improper Authentication in Apache CXF

Published
May 13, 2022
Last Modified
February 13, 2023

🔗 CVE IDs covered (1)

CVE-2012-0803 →

📋 Description

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request.

🎯 Affected products2

  • maven/org.apache.cxf:cxf:>= 2.4.0, <= 2.4.5
  • maven/org.apache.cxf:cxf:>= 2.5.0, <= 2.5.1

🔗 References (16)