CVE-2012-3451: Remote web-service operation execution in Apache CXF
Summary
CVE-2012-3451: Remote web-service operation execution in Apache CXF. Affects org.apache.cxf:cxf across 3 version ranges.
< 2.4.9
>= 2.5.0, < 2.5.5
>= 2.6.0, < 2.6.2
Fixed in 2.4.9, 2.5.5 or 2.6.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source, fully featured web services framework that helps users build and develop services using frontend programming APIs like JAX-WS and JAX-RS. It provides a flexible and extensible architecture that supports a wide range of web service standards and specifications. However, versions before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 are vulnerable to a remote web-service operation execution vulnerability.
Vulnerability Detail
The vulnerability in Apache CXF allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body. This can lead to unauthorized access, data leakage, or other malicious activities depending on the specific web service and its functionality. The vulnerability has a severity rating of HIGH and is classified under CWE-20.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.92.4.9 -
>= 2.5.0, < 2.5.52.5.5 -
>= 2.6.0, < 2.6.22.6.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed versions mentioned above.
Conclusion
The remote web-service operation execution vulnerability in Apache CXF can be mitigated by upgrading to the fixed versions mentioned above. It is crucial to keep software dependencies up to date to ensure the security and integrity of web services. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf →
FAQ
Apache CXF is an open-source web services framework that allows users to build and develop services using frontend programming APIs like JAX-WS and JAX-RS.
The vulnerability allows remote attackers to execute unintended web-service operations, which can lead to unauthorized access, data leakage, or other malicious activities.
The vulnerability has a severity rating of HIGH.
CWE-20 is a Common Weakness Enumeration category that represents input validation and representation issues.
To fix this vulnerability, it is recommended to upgrade to the latest secure version of Apache CXF (2.4.9, 2.5.5, or 2.6.2).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf.
