Описание
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB)
external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
A flaw was found in Apache CXF. The EndpointReferenceUtils and W3CMultiSchemaFactory classes within Apache CXF construct a SAXParserFactory without proper security configurations. This oversight enables out-of-band (OOB) external entity resolution, a type of XML External Entity (XXE) vulnerability. A remote attacker could exploit this to disclose sensitive information from the affected system.
Отчет
This is an Important information disclosure vulnerability in Apache CXF, affecting Red Hat products that bundle the component, such as Enterprise Application Platform, JBoss Web Server, and Red Hat Single Sign-On. The flaw allows a remote attacker to disclose sensitive information due to improper XML parsing configurations, which can be exploited without user interaction.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel 4 for Quarkus 3 | cxf-core | Affected | ||
| Red Hat Fuse 7 | cxf-core | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 7 | cxf-core | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 8 | cxf-core | Affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | cxf-core | Affected | ||
| Red Hat JBoss Web Server 5 | cxf-core | Fix deferred | ||
| Red Hat Single Sign-On 7 | cxf-core | Fix deferred | ||
| Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 | cxf-core | Fixed | RHSA-2026:37390 | 09.07.2026 |
| Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 | cxf-core | Fixed | RHSA-2026:36839 | 08.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
EPSS
7.5 High
CVSS3