The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasse

Summary

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.

Timeline

1. Mar 12, 2013, 10:00 PM UTCCVE published
2. Aug 6, 2024, 9:14 PM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• org.apache.cxf:cxfMaven

  fixed in 2.5.8

• org.apache.cxf:cxfMaven

  From 2.6.0 · fixed in 2.6.5

• org.apache.cxf:cxfMaven

  From 2.7.0 · fixed in 2.7.2

References 25