CVE-2012-5633: Improper Authentication in Apache CXF
Summary
CVE-2012-5633: Improper Authentication in Apache CXF. Affects org.apache.cxf:cxf across 3 version ranges.
< 2.5.8
>= 2.6.0, < 2.6.5
>= 2.7.0, < 2.7.2
Fixed in 2.5.8, 2.6.5 or 2.7.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that provides a comprehensive set of tools and libraries for building SOAP and RESTful services. It is widely used in Java-based applications to enable communication between different systems. The vulnerability identified as CVE-2012-5633 affects versions of Apache CXF prior to 2.5.8, 2.6.x prior to 2.6.5, and 2.7.x prior to 2.7.2. This vulnerability specifically impacts the URIMappingInterceptor when used in conjunction with the WSS4JInInterceptor. The URIMappingInterceptor fails to properly process WS-Security, allowing remote attackers to gain unauthorized access to SOAP services by exploiting an HTTP GET request.
Vulnerability Detail
The vulnerability in Apache CXF allows attackers to bypass WS-Security processing and gain unauthorized access to SOAP services. By sending a specially crafted HTTP GET request, remote attackers can exploit this vulnerability and potentially compromise the confidentiality, integrity, and availability of the SOAP services. This vulnerability has a moderate severity rating and is classified under CWE-287.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.82.5.8 -
>= 2.6.0, < 2.6.52.6.5 -
>= 2.7.0, < 2.7.22.7.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to a fixed version of Apache CXF as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Apache CXF allows remote attackers to bypass WS-Security processing and gain unauthorized access to SOAP services. It is crucial to upgrade to a fixed version of Apache CXF to mitigate this vulnerability and ensure the security of your SOAP services. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf →
FAQ
Apache CXF is an open-source web services framework used for building SOAP and RESTful services in Java-based applications.
This vulnerability allows remote attackers to gain unauthorized access to SOAP services, potentially compromising their confidentiality, integrity, and availability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version of Apache CXF.
You can find more information about this vulnerability in the CVE-2012-5633 entry or by contacting info@devnack.com for further support.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf.
