Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2012-0803GHSA-2P7X-JCR3-7P2C

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameTo

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 2.4.6, 2.5.2
None on Exploit-DB, Metasploit or GitHub

Summary

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • n/a n/a

    Version range not reported

  • org.apache.cxf:cxfMaven

    From 2.4.0 · fixed in 2.4.6

  • org.apache.cxf:cxfMaven

    From 2.5.0 · fixed in 2.5.2

References 8

marc.info

svn.apache.org

lists.apache.org