# org.apache.cxf:apache-cxf (Maven) vulnerabilities

7 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.cxf/apache-cxf

## Advisories (7)

### [CVE-2021-30468](https://cve.now/CVE-2021-30468): Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

- Severity: Unrated
- Published: Jun 16, 2021
- Affected: from 3.4.0, fixed in 3.4.4; fixed in 3.3.11.

### [CVE-2021-22696](https://cve.now/CVE-2021-22696): OAuth 2 authorization service vulnerable to DDos attacks

- Severity: Unrated
- Published: Apr 2, 2021
- Affected: from 3.4.0, fixed in 3.4.3; fixed in 3.3.10.

### [CVE-2020-13954](https://cve.now/CVE-2020-13954): Apache CXF Reflected XSS in the services listing page via the styleSheetPath

- Severity: Unrated
- Published: Nov 12, 2020
- Affected: fixed in 3.3.8; from 3.4.0, fixed in 3.4.1.

### [CVE-2019-17573](https://cve.now/CVE-2019-17573): By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.

- Severity: Unrated
- Published: Jan 16, 2020
- Affected: fixed in 3.2.12; from 3.3.0, fixed in 3.3.5.

### [CVE-2019-12423](https://cve.now/CVE-2019-12423): Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be…

- Severity: Unrated
- Published: Jan 16, 2020
- Affected: fixed in 3.2.12; from 3.3.0, fixed in 3.3.5.

### [CVE-2019-12406](https://cve.now/CVE-2019-12406): Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message.

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 3.2.11; from 3.3.0, fixed in 3.3.4.

### [CVE-2018-8039](https://cve.now/CVE-2018-8039): It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs"…

- Severity: Unrated
- Published: Jul 2, 2018
- Affected: from 3.2.0, fixed in 3.2.5; fixed in 3.1.16.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.cxf:apache-cxf
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.