Vulnerabilities > Apache > CXF > 2.4.3

DATE CVE VULNERABILITY TITLE RISK
2022-12-13 CVE-2022-46364 Server-Side Request Forgery (SSRF) vulnerability in Apache CXF
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 
network
low complexity
apache CWE-918
critical
9.8
2022-12-13 CVE-2022-46363 Improper Input Validation vulnerability in Apache CXF
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration.
network
low complexity
apache CWE-20
7.5
2021-06-16 CVE-2021-30468 Infinite Loop vulnerability in multiple products
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely.
network
low complexity
apache oracle CWE-835
7.5
2021-04-02 CVE-2021-22696 Server-Side Request Forgery (SSRF) vulnerability in multiple products
CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)).
network
low complexity
apache oracle CWE-918
7.5
2020-11-12 CVE-2020-13954 Cross-site Scripting vulnerability in multiple products
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.
network
low complexity
apache netapp oracle CWE-79
6.1
2020-04-01 CVE-2020-1954 Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus.
high complexity
apache oracle netapp
5.3
2020-03-11 CVE-2011-2487 Use of a Broken or Risky Cryptographic Algorithm vulnerability in multiple products
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
network
high complexity
apache redhat CWE-327
5.9
2020-01-16 CVE-2019-12423 Insufficiently Protected Credentials vulnerability in multiple products
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service.
network
low complexity
apache oracle CWE-522
7.5
2019-11-06 CVE-2019-12406 Allocation of Resources Without Limits or Throttling vulnerability in multiple products
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message.
network
low complexity
apache oracle CWE-770
6.5
2018-07-02 CVE-2018-8039 Improper Handling of Exceptional Conditions vulnerability in multiple products
It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'.
network
high complexity
apache redhat CWE-755
8.1