Cleartext Transmission of Sensitive Information in Apache CXF

MEDIUM 4.3CVE-2014-0035 · GHSA-v45r-rj5x-hpg2 · Published 07/07/2014 · updated 17/06/2026

In short

CVE-2014-0035 is a MEDIUM (CVSS 4.3) vulnerability affecting org.apache.cxf:cxf-core, cxf (apache), jboss enterprise application platform (redhat).
Chance of exploitation in the next 30 days (EPSS): 7.1%, higher than 94.2% of all vulnerabilities.
Fix: update to 2.7.10, 2.6.13 or later.

Package	Affected versions	Patched versions
org.apache.cxf:cxf-core Maven	`≥ 2.7.0, < 2.7.10< 2.6.13`	`2.7.102.6.13`
cxf apache	`= 2.6.0= 2.6.1= 2.6.10= 2.6.11= 2.6.2= 2.6.3= 2.6.4= 2.6.5= 2.6.6= 2.6.7= 2.6.8= 2.6.9= 2.7.0= 2.7.1= 2.7.2= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.7.9≤ 2.6.12`	No fix yet
jboss enterprise application platform redhat	`= 6.0.0= 6.2.0`	No fix yet

Description

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

NVD description

References

More vulnerabilities in org.apache.cxf:cxf-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free