PT-2017-5069 · Apache · Apache Cxf
CVE-2012-0803
·
Publicado
2017-08-08
·
Atualizado
2023-02-13
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Apache CXF versions 2.4.5 through 2.5.1
Description:
The issue allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request, specifically exploiting the WS-SP UsernameToken policy.
Recommendations:
For Apache CXF versions 2.4.5 and 2.5.1, consider disabling the WS-SP UsernameToken policy until a patch is available to prevent authentication bypass.
Correção
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Cxf