Описание
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility.
Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
Ссылки
- Mailing ListThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.6.8 (исключая)Версия от 4.0.0 (включая) до 4.0.9 (исключая)Версия от 4.1.0 (включая) до 4.1.3 (исключая)
Одно из
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
EPSS
Процентиль: 28%
0.00097
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-20
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 8.3
redhat
9 дней назад
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
EPSS
Процентиль: 28%
0.00097
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-20
NVD-CWE-noinfo