Description
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | apache-cxf | 2.2.12-10.patch_06.ep5.el5 | RHSA-2013:0259 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.4.9-6.redhat_3.ep6.el5 | RHSA-2013:0644 |
| Red Hat JBoss EAP 5 | apache-cxf | 2.2.12-10.patch_06.ep5.el4 | RHSA-2013:0257 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cxf:cxf | < 2.5.8 | 2.5.8 | GHSA-xf9f-32gh-h2w4 |
| Maven | org.apache.cxf:cxf | >= 2.6.0, < 2.6.5 | 2.6.5 | GHSA-xf9f-32gh-h2w4 |
| Maven | org.apache.cxf:cxf | >= 2.7.0, < 2.7.2 | 2.7.2 | GHSA-xf9f-32gh-h2w4 |
Advisories 3
- RHSA-2013:0644 Red Hat Security Advisory: apache-cxf security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0257 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0259 Red Hat Security Advisory: JBoss Enterprise Web Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- 51988 third-party-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1409324
- http://stackoverflow.com/questions/7933293/why-does-apache-cxf-ws-security-implementation-ignore-get-requests
- 20130208 New security advisories for Apache CXF mailing-list
- RHSA-2013:0256 vendor-advisory
- 90079 vdb-entry
- RHSA-2013:0257 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1420698
- https://issues.jboss.org/browse/JBWS-3575
- 57874 vdb-entry
- https://issues.apache.org/jira/browse/CXF-4629
- RHSA-2013:0258 vendor-advisory
- 52183 third-party-advisory
- RHSA-2013:0749 vendor-advisory
- RHSA-2013:0743 vendor-advisory
- http://packetstormsecurity.com/files/120213/Apache-CXF-WS-Security-URIMappingInterceptor-Bypass.html
- http://cxf.apache.org/cve-2012-5633.html
- apachecxf-wssecurity-security-bypass(81980) vdb-entry
- RHSA-2013:0259 vendor-advisory
- RHSA-2013:0726 vendor-advisory
- [cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html mailing-list