GHSA-55j7-f5wf-43m4High

Remote web-service operation execution in Apache CXF

Published
May 13, 2022
Last Modified
December 21, 2023

🔗 CVE IDs covered (1)

CVE-2012-3451 →

📋 Description

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.

🎯 Affected products3

  • maven/org.apache.cxf:cxf:< 2.4.9
  • maven/org.apache.cxf:cxf:>= 2.5.0, < 2.5.5
  • maven/org.apache.cxf:cxf:>= 2.6.0, < 2.6.2

🔗 References (31)