org.apache.cxf:cxf-rt-core@2.3.2 vulnerabilities
latest version
2.7.18
latest non vulnerable version
first published
16 years ago
latest version published
9 years ago
licenses detected
- [2.0.6,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.cxf:cxf-rt-core package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body. In some cases, CXF uses the received SOAP Action to select the correct operation to invoke, and does not check to see that the message body is correct. This can be exploitable to execute a SOAP Action spoofing attack, where an adversary can execute another operation in the web service by sending the corresponding SOAP Action. This attack only works if the different operation takes the same parameter types, and hence has somewhat limited applicability. This attack also only applies for web services that use unique SOAPActions per service operation which is not the default in CXF. Also note that WS-Policy validation is done against the operation being invoked and thus the incoming message must meet those policy requirements as well, also limiting applicability. | [0,2.4.9)[2.5.0,2.5.5) |
org.apache.cxf:cxf-rt-core is an Apache CXF Runtime Core Affected versions of this package are vulnerable to Improper Authentication.
The How to fix Improper Authentication? Upgrade | [,2.5.8) |