Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5.8
CVSSv2

CVE-2012-5633

Published: 12/03/2013 Updated: 13/02/2023
CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6
VMScore: 516
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Subscribe to Cxf

Vulnerability Summary

The URIMappingInterceptor in Apache CXF prior to 2.5.8, 2.6.x prior to 2.6.5, and 2.7.x prior to 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote malicious users to obtain access to SOAP services via an HTTP GET request.

Vulnerable Product Search on Vulmon Subscribe to Product

apache cxf 2.5.2

apache cxf 2.5.3

apache cxf 2.5.0

apache cxf 2.5.1

apache cxf 2.5.5

apache cxf 2.5.6

apache cxf

apache cxf 2.5.4

apache cxf 2.6.0

apache cxf 2.6.2

apache cxf 2.6.3

apache cxf 2.6.4

apache cxf 2.6.1

apache cxf 2.7.0

apache cxf 2.7.1

Vendor Advisories

Red Hat: Important: apache-cxf security update
Synopsis Important: apache-cxf security update Type/Severity Security Advisory: Important Topic An updated apache-cxf package for JBoss Enterprise Application Platform601 which fixes two security issues is now available for Red HatEnterprise Linux 5 and 6The Red Hat Security Response Team has rated this ...
Red Hat: Important: JBoss Enterprise Application Platform 5.2.0 security update
Synopsis Important: JBoss Enterprise Application Platform 520 security update Type/Severity Security Advisory: Important Topic An update for JBoss Enterprise Application Platform 520 which fixes twosecurity issues is now available from the Red Hat Customer PortalThe Red Hat Security Response Team has r ...
Red Hat: Important: JBoss Enterprise Web Platform 5.2.0 security update
Synopsis Important: JBoss Enterprise Web Platform 520 security update Type/Severity Security Advisory: Important Topic An update for JBoss Enterprise Web Platform 520 which fixes two securityissues is now available from the Red Hat Customer PortalThe Red Hat Security Response Team has rated this update ...
Red Hat: Important: apache-cxf security update
Synopsis Important: apache-cxf security update Type/Severity Security Advisory: Important Topic An update for the Apache CXF component of JBoss Portal Platform 600 whichfixes two security issues is now available from the Red Hat CustomerPortalThe Red Hat Security Response Team has rated this update as ha ...
Red Hat: Important: JBoss Enterprise SOA Platform 5.3.1 update
Synopsis Important: JBoss Enterprise SOA Platform 531 update Type/Severity Security Advisory: Important Topic JBoss Enterprise SOA Platform 531 roll up patch 1, which fixes multiplesecurity issues and various bugs, is now available from the Red HatCustomer PortalThe Red Hat Security Response Team has r ...
Red Hat: Important: JBoss Enterprise Web Platform 5.2.0 security update
Synopsis Important: JBoss Enterprise Web Platform 520 security update Type/Severity Security Advisory: Important Topic An updated apache-cxf package for JBoss Enterprise Web Platform 520 thatfixes two security issues is now available for Red Hat Enterprise Linux 4,5, and 6The Red Hat Security Response ...
Red Hat: Important: JBoss Enterprise Application Platform 5.2.0 security update
Synopsis Important: JBoss Enterprise Application Platform 520 security update Type/Severity Security Advisory: Important Topic An updated apache-cxf package for JBoss Enterprise Application Platform520 that fixes two security issues is now available for Red HatEnterprise Linux 4, 5, and 6The Red Hat Se ...
Red Hat: Important: JBoss Enterprise BRMS Platform 5.3.1 update
Synopsis Important: JBoss Enterprise BRMS Platform 531 update Type/Severity Security Advisory: Important Topic JBoss Enterprise BRMS Platform 531 roll up patch 1, which fixes twosecurity issues and various bugs, is now available from the Red HatCustomer PortalThe Red Hat Security Response Team has rate ...

References

CWE-287http://rhn.redhat.com/errata/RHSA-2013-0259.htmlhttp://secunia.com/advisories/51988http://svn.apache.org/viewvc?view=revision&revision=1420698https://issues.jboss.org/browse/JBWS-3575http://secunia.com/advisories/52183http://stackoverflow.com/questions/7933293/why-does-apache-cxf-ws-security-implementation-ignore-get-requestshttp://packetstormsecurity.com/files/120213/Apache-CXF-WS-Security-URIMappingInterceptor-Bypass.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0256.htmlhttp://osvdb.org/90079http://seclists.org/fulldisclosure/2013/Feb/39http://www.securityfocus.com/bid/57874http://svn.apache.org/viewvc?view=revision&revision=1409324http://rhn.redhat.com/errata/RHSA-2013-0258.htmlhttps://issues.apache.org/jira/browse/CXF-4629http://rhn.redhat.com/errata/RHSA-2013-0257.htmlhttp://cxf.apache.org/cve-2012-5633.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0726.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0743.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0749.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/81980https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3Ehttps://nvd.nist.govhttps://access.redhat.com/errata/RHSA-2013:0644
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-32744privilege escalationCVE-2024-30253CVE-2024-3914cross-site scriptingCVE-2024-31497CVE-2024-3400CVE-2024-32341hardcoded
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook