CVE-2012-2378: Improper Authentication in Apache CXF
Summary
CVE-2012-2378: Improper Authentication in Apache CXF. Affects org.apache.cxf:cxf across 3 version ranges.
>= 2.4.5, < 2.4.8
>= 2.5.1, < 2.5.3
>= 2.6.0, < 2.6.1
Fixed in 2.4.8, 2.5.3 or 2.6.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that provides a comprehensive set of tools and libraries for developing SOAP and RESTful services. It is widely used in Java-based applications to enable communication between different systems. However, versions 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1 of Apache CXF are vulnerable to an improper authentication issue.
Vulnerability Detail
The vulnerability in Apache CXF arises from the failure to properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side. This allows remote attackers to bypass several important security policies, including AlgorithmSuite, SignedParts, SignedElements, EncryptedParts, and EncryptedElements. As a result, an attacker could potentially manipulate or access sensitive data, compromise the integrity of the communication, or perform unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.5, < 2.4.82.4.8 -
>= 2.5.1, < 2.5.32.5.3 -
>= 2.6.0, < 2.6.12.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the affected WS-SecurityPolicy 1.1 SupportingToken policy on the client side. However, this may leave your application vulnerable to other security risks, so it is strongly advised to apply the recommended fix by upgrading to a fixed version of Apache CXF.
Conclusion
The improper authentication vulnerability in Apache CXF can have serious security implications, potentially allowing attackers to bypass important security policies. It is crucial to upgrade to a fixed version of Apache CXF (2.4.8, 2.5.3, or 2.6.1) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf →
FAQ
Apache CXF is an open-source web services framework for developing SOAP and RESTful services in Java.
Versions 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1 of Apache CXF are affected.
The vulnerability allows remote attackers to bypass important security policies, potentially leading to unauthorized access, data manipulation, or compromise of communication integrity.
To fix this vulnerability, you should upgrade to a fixed version of Apache CXF (2.4.8, 2.5.3, or 2.6.1).
A temporary workaround is to disable the affected WS-SecurityPolicy 1.1 SupportingToken policy on the client side, but it is recommended to apply the fix by upgrading Apache CXF.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf.
