# org.apache.cxf:cxf (Maven) vulnerabilities

12 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.cxf/cxf

## Advisories (12)

### [CVE-2021-30468](https://cve.now/CVE-2021-30468): Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

- Severity: Unrated
- Published: Jun 16, 2021
- Affected: from 3.4.0, fixed in 3.4.4; fixed in 3.3.11.

### [CVE-2021-22696](https://cve.now/CVE-2021-22696): OAuth 2 authorization service vulnerable to DDos attacks

- Severity: Unrated
- Published: Apr 2, 2021
- Affected: from 3.4.0, fixed in 3.4.3; fixed in 3.3.10.

### [CVE-2020-13954](https://cve.now/CVE-2020-13954): Apache CXF Reflected XSS in the services listing page via the styleSheetPath

- Severity: Unrated
- Published: Nov 12, 2020
- Affected: fixed in 3.3.8; from 3.4.0, fixed in 3.4.1.

### [CVE-2019-17573](https://cve.now/CVE-2019-17573): By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.

- Severity: Unrated
- Published: Jan 16, 2020
- Affected: fixed in 3.2.12; from 3.3.0, fixed in 3.3.5.

### [CVE-2019-12423](https://cve.now/CVE-2019-12423): Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be…

- Severity: Unrated
- Published: Jan 16, 2020
- Affected: fixed in 3.2.12; from 3.3.0, fixed in 3.3.5.

### [CVE-2019-12419](https://cve.now/CVE-2019-12419): Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service.

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 3.2.11; from 3.3.0, fixed in 3.3.4.

### [CVE-2019-12406](https://cve.now/CVE-2019-12406): Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message.

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 3.2.11; from 3.3.0, fixed in 3.3.4.

### [CVE-2012-0803](https://cve.now/CVE-2012-0803): The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty…

- Severity: Unrated
- Published: Aug 8, 2017
- Affected: from 2.4.0, fixed in 2.4.6; from 2.5.0, fixed in 2.5.2.

### [CVE-2012-5633](https://cve.now/CVE-2012-5633): The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor…

- Severity: Unrated
- Published: Mar 12, 2013
- Affected: fixed in 2.5.8; from 2.6.0, fixed in 2.6.5; from 2.7.0, fixed in 2.7.2.

### [CVE-2012-2378](https://cve.now/CVE-2012-2378): Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a…

- Severity: Unrated
- Published: Jan 5, 2013
- Affected: from 2.4.5, fixed in 2.4.8; from 2.5.1, fixed in 2.5.3; from 2.6.0, fixed in 2.6.1.

### [CVE-2012-2379](https://cve.now/CVE-2012-2379): Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1…

- Severity: Unrated
- Published: Jan 3, 2013
- Affected: from 2.4.0, fixed in 2.4.8; from 2.5.0, fixed in 2.5.4; from 2.6.0, fixed in 2.6.1.

### [CVE-2012-3451](https://cve.now/CVE-2012-3451): Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations…

- Severity: Unrated
- Published: Sep 24, 2012
- Affected: fixed in 2.4.9; from 2.5.0, fixed in 2.5.5; from 2.6.0, fixed in 2.6.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.cxf:cxf
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.