CVE-2013-2160

Опубликовано: 19 авг. 2013

Источник: nvd

CVSS2: 5

EPSS Средний

Описание

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:cxf:2.5.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.5.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.6.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:cxf:2.7.3:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.203

Средний

5 Medium

CVSS2

Дефекты

CWE-399

Связанные уязвимости

CVE-2013-2160

redhat

около 12 лет назад

GHSA-254q-rp36-v2m8

github

больше 3 лет назад

Missing XML Validation in Apache CXF