CVE-2012-0803: Improper Authentication in Apache CXF
Summary
CVE-2012-0803: Improper Authentication in Apache CXF. Affects org.apache.cxf:cxf across 2 version ranges.
>= 2.4.0, < 2.4.6
>= 2.5.0, < 2.5.2
Fixed in 2.4.6 or 2.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that allows developers to build and deploy SOAP and RESTful web services. It provides a comprehensive set of tools and libraries for developing web services using Java. The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 is vulnerable to an improper authentication issue.
Vulnerability Detail
The vulnerability in Apache CXF allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request. This means that an attacker can gain unauthorized access to the system without providing valid credentials. The impact of this vulnerability can be severe, as it allows attackers to perform unauthorized actions and potentially compromise the integrity and confidentiality of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.0, < 2.4.62.4.6 -
>= 2.5.0, < 2.5.22.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a fixed version of Apache CXF.
Conclusion
The vulnerability in Apache CXF allows remote attackers to bypass authentication and gain unauthorized access to the system. It is crucial to apply the recommended fix by upgrading to a fixed version of Apache CXF to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf →
FAQ
Apache CXF is an open-source web services framework for developing SOAP and RESTful web services using Java.
The vulnerability allows remote attackers to bypass authentication and gain unauthorized access to the system, potentially compromising its integrity and confidentiality.
Versions 2.4.0 to 2.4.5 and versions 2.5.0 to 2.5.1 of Apache CXF are affected.
To fix this vulnerability, upgrade to Apache CXF version 2.4.6 or later if using versions 2.4.0 to 2.4.5, or upgrade to version 2.5.2 or later if using versions 2.5.0 to 2.5.1.
No, there is no known workaround for this vulnerability. It is necessary to apply the recommended fix by upgrading to a fixed version of Apache CXF.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf.
