| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.cxf:cxf-core | ≥ 3.1.0, < 3.1.11< 3.0.13 | 3.1.113.0.13 |
| cxf | ≥ 3.0.0, ≤ 3.0.13≥ 3.1.0, ≤ 3.1.11 |
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free