org.apache.cxf:cxf-core@3.0.12 vulnerabilities
latest version
4.1.0
latest non vulnerable version
first published
11 years ago
latest version published
13 days ago
licenses detected
- [3.0.0-milestone1,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.cxf:cxf-core package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) as the NOTE
This vulnerability exists when using How to fix Server-side Request Forgery (SSRF)? Upgrade | [,3.4.10)[3.5.0,3.5.5) |
org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Denial of Service (DoS). Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property attachment-max-header-size. How to fix Denial of Service (DoS)? Upgrade | [,3.1.14)[3.2.0,3.2.1) |