En resumen
- CVE-2012-2378 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a org.apache.cxf:cxf, cxf (apache).
- Probabilidad de explotación en los próximos 30 días (EPSS): 3.9%, mayor que el 90.4% de las vulnerabilidades.
- Solución: actualizar a 2.4.8, 2.5.3, 2.6.1 o posterior.
| Package | Affected versions | Patched versions |
|---|
| org.apache.cxf:cxf Maven | ≥ 2.4.5, < 2.4.8≥ 2.5.1, < 2.5.3≥ 2.6.0, < 2.6.1
| 2.4.82.5.32.6.1
|
| cxf | = 2.4.5= 2.4.6= 2.4.7= 2.5.1= 2.5.2= 2.5.3= 2.6.0
| No fix yet |
Description
Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
NVD description
Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
Más vulnerabilidades de org.apache.cxf:cxf
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free