Improper Authentication in Apache CXF

MEDIUM 5.0CVE-2013-0239 · GHSA-p5c5-6564-vvr8 · Published 12/03/2013 · updated 16/06/2026

In short

CVE-2013-0239 is a MEDIUM (CVSS 5.0) vulnerability affecting org.apache.cxf:cxf-rt-frontend-jaxrs, cxf (apache).
Chance of exploitation in the next 30 days (EPSS): 4.7%, higher than 91.8% of all vulnerabilities.
Fix: update to 2.6.6, 2.7.3, 2.5.9 or later.

Package	Affected versions	Patched versions
org.apache.cxf:cxf-rt-frontend-jaxrs Maven	`≥ 2.6.0, < 2.6.6≥ 2.7.0, < 2.7.3< 2.5.9`	`2.6.62.7.32.5.9`
cxf apache	`= 2.4.0= 2.4.1= 2.4.2= 2.4.3= 2.4.4= 2.4.5= 2.4.6= 2.4.7= 2.5.0= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5= 2.5.6= 2.5.7= 2.6.0= 2.6.1= 2.6.2= 2.6.3= 2.6.4= 2.6.5= 2.7.0= 2.7.1= 2.7.2≤ 2.5.8`	No fix yet

Description

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

NVD description

References

More vulnerabilities in org.apache.cxf:cxf-rt-frontend-jaxrs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free