Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2013-0239

Published: 12/03/2013 Updated: 13/02/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Subscribe to Cxf

Vulnerability Summary

Apache CXF prior to 2.5.9, 2.6.x prior to 2.6.6, and 2.7.x prior to 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote malicious users to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

Vulnerable Product Search on Vulmon Subscribe to Product

apache cxf 2.5.2

apache cxf 2.4.6

apache cxf 2.5.3

apache cxf 2.4.0

apache cxf 2.4.3

apache cxf 2.5.7

apache cxf 2.4.4

apache cxf 2.4.2

apache cxf 2.5.0

apache cxf 2.5.1

apache cxf 2.5.5

apache cxf

apache cxf 2.4.1

apache cxf 2.5.6

apache cxf 2.4.7

apache cxf 2.4.5

apache cxf 2.5.4

apache cxf 2.6.0

apache cxf 2.6.2

apache cxf 2.6.5

apache cxf 2.6.3

apache cxf 2.6.4

apache cxf 2.6.1

apache cxf 2.7.0

apache cxf 2.7.1

apache cxf 2.7.2

Vendor Advisories

Red Hat: Important: apache-cxf security update
Synopsis Important: apache-cxf security update Type/Severity Security Advisory: Important Topic An updated apache-cxf package for JBoss Enterprise Application Platform601 which fixes two security issues is now available for Red HatEnterprise Linux 5 and 6The Red Hat Security Response Team has rated this ...
Red Hat: Important: apache-cxf security update
Synopsis Important: apache-cxf security update Type/Severity Security Advisory: Important Topic An update for the Apache CXF component of JBoss Portal Platform 600 whichfixes two security issues is now available from the Red Hat CustomerPortalThe Red Hat Security Response Team has rated this update as ha ...

References

CWE-287http://www.securityfocus.com/bid/57876http://svn.apache.org/viewvc?view=revision&revision=1438424http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.htmlhttp://cxf.apache.org/cve-2013-0239.htmlhttp://secunia.com/advisories/51988http://seclists.org/fulldisclosure/2013/Feb/39http://osvdb.org/90078http://rhn.redhat.com/errata/RHSA-2013-0749.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/81981https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3Ehttps://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3Ehttps://access.redhat.com/errata/RHSA-2013:0644https://nvd.nist.gov
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook