PT-2026-80304 · Maven · Org.Apache.Cxf:Cxf-Integration-Jca

Publicado

2026-06-12

·

Atualizado

2026-06-12

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Correção

Deserialization of Untrusted Data

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-502CWE-20

Identificadores relacionados

GHSA-QP3F-RVJ8-46C8

Produtos afetados

Org.Apache.Cxf:Cxf-Integration-Jca