Описание
The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.
Ссылки
- PatchVendor Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- PatchVendor Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
Уязвимые конфигурации
Конфигурация 1Версия до 3.0.11 (включая)
Одно из
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:3.1.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:3.1.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:3.1.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:3.1.8:*:*:*:*:*:*:*
EPSS
Процентиль: 85%
0.02672
Низкий
7.5 High
CVSS3
7.8 High
CVSS2
Дефекты
CWE-611
Связанные уязвимости
CVSS3: 6.5
redhat
около 9 лет назад
The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.
CVSS3: 7.5
github
больше 3 лет назад
Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS
EPSS
Процентиль: 85%
0.02672
Низкий
7.5 High
CVSS3
7.8 High
CVSS2
Дефекты
CWE-611