{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Fuse ESB Enterprise 7.1.0 Patch 3, which fixes three security issues and\nvarious bugs, is now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Fuse ESB Enterprise, based on Apache ServiceMix, provides an integration\nplatform.\n\nThis release of Fuse ESB Enterprise 7.1.0 Patch 3 is an update to Fuse ESB\nEnterprise 7.1.0 and includes bug fixes. Refer to the readme file included\nwith the patch files for information about the bug fixes.\n\nThe following security issues are also fixed with this release:\n\nIf web services were deployed using Apache CXF with the WSS4JInInterceptor\nenabled to apply WS-Security processing, HTTP GET requests to these\nservices were always granted access, without applying authentication\nchecks. The URIMappingInterceptor is a legacy mechanism for allowing\nREST-like access (via GET requests) to simple SOAP services. A remote\nattacker could use this flaw to access the REST-like interface of a simple\nSOAP service using GET requests that bypass the security constraints\napplied by WSS4JInInterceptor. This flaw was only exploitable if\nWSS4JInInterceptor was used to apply WS-Security processing. Services that\nuse WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633)\n\nIt was found that the Apache CXF UsernameTokenPolicyValidator and\nUsernameTokenInterceptor allowed a UsernameToken element with no password\nchild element to bypass authentication. A remote attacker could use this\nflaw to circumvent access controls applied to web services by omitting the\npassword in a UsernameToken. This flaw was exploitable on web services that\nrely on WS-SecurityPolicy plain text UsernameTokens to authenticate users.\nIt was not exploitable when using hashed passwords or WS-Security without\nWS-SecurityPolicy. (CVE-2013-0239)\n\nA flaw was found in the way the Spring Security Framework\nDaoAuthenticationProvider performed user authentication. A remote attacker\ncould possibly use this flaw to determine if a username was valid or not by\nobserving the time differences during attempted authentication. A caller to\nan Apache Camel route could possibly use this flaw to perform a\nside-channel timing attacking to find valid usernames (but not their\npasswords). (CVE-2012-5055)\n\nAll users of Fuse ESB Enterprise 7.1.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Fuse ESB Enterprise 7.1.0 Patch\n3.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0649",
        "url": "https://access.redhat.com/errata/RHSA-2013:0649"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/cve-2012-5633.html",
        "url": "http://cxf.apache.org/cve-2012-5633.html"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/cve-2013-0239.html",
        "url": "http://cxf.apache.org/cve-2013-0239.html"
      },
      {
        "category": "external",
        "summary": "http://support.springsource.com/security/cve-2012-5055",
        "url": "http://support.springsource.com/security/cve-2012-5055"
      },
      {
        "category": "external",
        "summary": "886031",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=886031"
      },
      {
        "category": "external",
        "summary": "889008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
      },
      {
        "category": "external",
        "summary": "905722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0649.json"
      }
    ],
    "title": "Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update",
    "tracking": {
      "current_release_date": "2024-11-22T06:21:06+00:00",
      "generator": {
        "date": "2024-11-22T06:21:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:0649",
      "initial_release_date": "2013-03-14T16:40:00+00:00",
      "revision_history": [
        {
          "date": "2013-03-14T16:40:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-03-14T16:48:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T06:21:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Fuse ESB Enterprise 7.1.0",
                "product": {
                  "name": "Fuse ESB Enterprise 7.1.0",
                  "product_id": "Fuse ESB Enterprise 7.1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:fuse_esb_enterprise:7.1.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Fuse Enterprise Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5055",
      "discovery_date": "2012-12-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "886031"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Security: Ability to determine if username is valid via DaoAuthenticationProvider",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5055"
        },
        {
          "category": "external",
          "summary": "RHBZ#886031",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=886031"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5055",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5055"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5055",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5055"
        }
      ],
      "release_date": "2012-10-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-14T16:40:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0649"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Security: Ability to determine if username is valid via DaoAuthenticationProvider"
    },
    {
      "cve": "CVE-2012-5633",
      "discovery_date": "2012-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "889008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "RHBZ#889008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-14T16:40:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0649"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor"
    },
    {
      "cve": "CVE-2013-0239",
      "discovery_date": "2013-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "905722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "RHBZ#905722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0239",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-14T16:40:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0649"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated apache-cxf package for JBoss Enterprise Application Platform\n6.0.1 which fixes two security issues is now available for Red Hat\nEnterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache CXF is an open source services framework.\n\nIt was found that the Apache CXF UsernameTokenPolicyValidator and\nUsernameTokenInterceptor allowed a UsernameToken element with no password\nchild element to bypass authentication. A remote attacker could use this\nflaw to circumvent access controls applied to web services by omitting the\npassword in a UsernameToken. This flaw was exploitable on web services that\nrely on WS-SecurityPolicy plain text UsernameTokens to authenticate users.\nIt was not exploitable when using hashed passwords or WS-Security without\nWS-SecurityPolicy. (CVE-2013-0239)\n\nIf web services were deployed using Apache CXF with the WSS4JInInterceptor\nenabled to apply WS-Security processing, HTTP GET requests to these\nservices were always granted access, without applying authentication\nchecks. The URIMappingInterceptor is a legacy mechanism for allowing\nREST-like access (via GET requests) to simple SOAP services. A remote\nattacker could use this flaw to access the REST-like interface of a simple\nSOAP service using GET requests that bypass the security constraints\napplied by WSS4JInInterceptor. This flaw was only exploitable if\nWSS4JInInterceptor was used to apply WS-Security processing. Services that\nuse WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633)\n\nWarning: Before applying this update, back up your existing JBoss\nEnterprise Application Platform installation and deployed applications.\n\nAll users of JBoss Enterprise Application Platform 6.0.1 on Red Hat\nEnterprise Linux 5 and 6 are advised to upgrade to this updated package.\nThe JBoss server process must be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0644",
        "url": "https://access.redhat.com/errata/RHSA-2013:0644"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/security-advisories.html",
        "url": "http://cxf.apache.org/security-advisories.html"
      },
      {
        "category": "external",
        "summary": "889008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
      },
      {
        "category": "external",
        "summary": "905722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0644.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache-cxf security update",
    "tracking": {
      "current_release_date": "2024-11-22T06:20:49+00:00",
      "generator": {
        "date": "2024-11-22T06:20:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:0644",
      "initial_release_date": "2013-03-13T18:45:00+00:00",
      "revision_history": [
        {
          "date": "2013-03-13T18:45:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-03-13T18:49:09+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T06:20:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
                "product": {
                  "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
                  "product_id": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src",
                "product": {
                  "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src",
                  "product_id": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
                "product": {
                  "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
                  "product_id": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
                "product": {
                  "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
                  "product_id": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch"
        },
        "product_reference": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src"
        },
        "product_reference": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch"
        },
        "product_reference": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
        },
        "product_reference": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5633",
      "discovery_date": "2012-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "889008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
          "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
          "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
          "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "RHBZ#889008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-13T18:45:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0644"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor"
    },
    {
      "cve": "CVE-2013-0239",
      "discovery_date": "2013-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "905722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
          "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
          "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
          "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "RHBZ#905722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0239",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-13T18:45:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0644"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache CXF component of JBoss Enterprise Application\nPlatform 6.0.1 which fixes two security issues is now available from the\nRed Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache CXF is an open source services framework.\n\nIt was found that the Apache CXF UsernameTokenPolicyValidator and\nUsernameTokenInterceptor allowed a UsernameToken element with no password\nchild element to bypass authentication. A remote attacker could use this\nflaw to circumvent access controls applied to web services by omitting the\npassword in a UsernameToken. This flaw was exploitable on web services that\nrely on WS-SecurityPolicy plain text UsernameTokens to authenticate users.\nIt was not exploitable when using hashed passwords or WS-Security without\nWS-SecurityPolicy. (CVE-2013-0239)\n\nIf web services were deployed using Apache CXF with the WSS4JInInterceptor\nenabled to apply WS-Security processing, HTTP GET requests to these\nservices were always granted access, without applying authentication\nchecks. The URIMappingInterceptor is a legacy mechanism for allowing\nREST-like access (via GET requests) to simple SOAP services. A remote\nattacker could use this flaw to access the REST-like interface of a simple\nSOAP service using GET requests that bypass the security constraints\napplied by WSS4JInInterceptor. This flaw was only exploitable if\nWSS4JInInterceptor was used to apply WS-Security processing. Services that\nuse WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633)\n\nWarning: Before applying this update, back up your existing JBoss\nEnterprise Application Platform installation and deployed applications.\n\nAll users of JBoss Enterprise Application Platform 6.0.1 as provided from\nthe Red Hat Customer Portal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0645",
        "url": "https://access.redhat.com/errata/RHSA-2013:0645"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.0.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.0.1"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/security-advisories.html",
        "url": "http://cxf.apache.org/security-advisories.html"
      },
      {
        "category": "external",
        "summary": "889008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
      },
      {
        "category": "external",
        "summary": "905722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0645.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache-cxf security update",
    "tracking": {
      "current_release_date": "2026-01-28T22:54:22+00:00",
      "generator": {
        "date": "2026-01-28T22:54:22+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.16"
        }
      },
      "id": "RHSA-2013:0645",
      "initial_release_date": "2013-03-13T18:43:00+00:00",
      "revision_history": [
        {
          "date": "2013-03-13T18:43:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:45:50+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-01-28T22:54:22+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.0",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.0",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.0.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5633",
      "discovery_date": "2012-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "889008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "RHBZ#889008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-13T18:43:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Enterprise Application Platform installation and deployed\napplications.\n\nThe JBoss server process must be restarted for this update to take effect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0645"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor"
    },
    {
      "cve": "CVE-2013-0239",
      "discovery_date": "2013-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "905722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "RHBZ#905722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0239",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-13T18:43:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Enterprise Application Platform installation and deployed\napplications.\n\nThe JBoss server process must be restarted for this update to take effect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0645"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Fuse ESB Enterprise 7.1.0 Patch 3, which fixes three security issues and\nvarious bugs, is now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Fuse ESB Enterprise, based on Apache ServiceMix, provides an integration\nplatform.\n\nThis release of Fuse ESB Enterprise 7.1.0 Patch 3 is an update to Fuse ESB\nEnterprise 7.1.0 and includes bug fixes. Refer to the readme file included\nwith the patch files for information about the bug fixes.\n\nThe following security issues are also fixed with this release:\n\nIf web services were deployed using Apache CXF with the WSS4JInInterceptor\nenabled to apply WS-Security processing, HTTP GET requests to these\nservices were always granted access, without applying authentication\nchecks. The URIMappingInterceptor is a legacy mechanism for allowing\nREST-like access (via GET requests) to simple SOAP services. A remote\nattacker could use this flaw to access the REST-like interface of a simple\nSOAP service using GET requests that bypass the security constraints\napplied by WSS4JInInterceptor. This flaw was only exploitable if\nWSS4JInInterceptor was used to apply WS-Security processing. Services that\nuse WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633)\n\nIt was found that the Apache CXF UsernameTokenPolicyValidator and\nUsernameTokenInterceptor allowed a UsernameToken element with no password\nchild element to bypass authentication. A remote attacker could use this\nflaw to circumvent access controls applied to web services by omitting the\npassword in a UsernameToken. This flaw was exploitable on web services that\nrely on WS-SecurityPolicy plain text UsernameTokens to authenticate users.\nIt was not exploitable when using hashed passwords or WS-Security without\nWS-SecurityPolicy. (CVE-2013-0239)\n\nA flaw was found in the way the Spring Security Framework\nDaoAuthenticationProvider performed user authentication. A remote attacker\ncould possibly use this flaw to determine if a username was valid or not by\nobserving the time differences during attempted authentication. A caller to\nan Apache Camel route could possibly use this flaw to perform a\nside-channel timing attacking to find valid usernames (but not their\npasswords). (CVE-2012-5055)\n\nAll users of Fuse ESB Enterprise 7.1.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Fuse ESB Enterprise 7.1.0 Patch\n3.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0649",
        "url": "https://access.redhat.com/errata/RHSA-2013:0649"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/cve-2012-5633.html",
        "url": "http://cxf.apache.org/cve-2012-5633.html"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/cve-2013-0239.html",
        "url": "http://cxf.apache.org/cve-2013-0239.html"
      },
      {
        "category": "external",
        "summary": "http://support.springsource.com/security/cve-2012-5055",
        "url": "http://support.springsource.com/security/cve-2012-5055"
      },
      {
        "category": "external",
        "summary": "886031",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=886031"
      },
      {
        "category": "external",
        "summary": "889008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
      },
      {
        "category": "external",
        "summary": "905722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0649.json"
      }
    ],
    "title": "Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update",
    "tracking": {
      "current_release_date": "2026-01-28T22:54:21+00:00",
      "generator": {
        "date": "2026-01-28T22:54:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.16"
        }
      },
      "id": "RHSA-2013:0649",
      "initial_release_date": "2013-03-14T16:40:00+00:00",
      "revision_history": [
        {
          "date": "2013-03-14T16:40:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-03-14T16:48:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-01-28T22:54:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Fuse ESB Enterprise 7.1.0",
                "product": {
                  "name": "Fuse ESB Enterprise 7.1.0",
                  "product_id": "Fuse ESB Enterprise 7.1.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:fuse_esb_enterprise:7.1.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Fuse Enterprise Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5055",
      "discovery_date": "2012-12-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "886031"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Security: Ability to determine if username is valid via DaoAuthenticationProvider",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5055"
        },
        {
          "category": "external",
          "summary": "RHBZ#886031",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=886031"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5055",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5055"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5055",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5055"
        }
      ],
      "release_date": "2012-10-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-14T16:40:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0649"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Security: Ability to determine if username is valid via DaoAuthenticationProvider"
    },
    {
      "cve": "CVE-2012-5633",
      "discovery_date": "2012-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "889008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "RHBZ#889008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-14T16:40:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0649"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor"
    },
    {
      "cve": "CVE-2013-0239",
      "discovery_date": "2013-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "905722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Fuse ESB Enterprise 7.1.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "RHBZ#905722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0239",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-14T16:40:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Fuse ESB Enterprise 7.1.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0649"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Fuse ESB Enterprise 7.1.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated apache-cxf package for JBoss Enterprise Application Platform\n6.0.1 which fixes two security issues is now available for Red Hat\nEnterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache CXF is an open source services framework.\n\nIt was found that the Apache CXF UsernameTokenPolicyValidator and\nUsernameTokenInterceptor allowed a UsernameToken element with no password\nchild element to bypass authentication. A remote attacker could use this\nflaw to circumvent access controls applied to web services by omitting the\npassword in a UsernameToken. This flaw was exploitable on web services that\nrely on WS-SecurityPolicy plain text UsernameTokens to authenticate users.\nIt was not exploitable when using hashed passwords or WS-Security without\nWS-SecurityPolicy. (CVE-2013-0239)\n\nIf web services were deployed using Apache CXF with the WSS4JInInterceptor\nenabled to apply WS-Security processing, HTTP GET requests to these\nservices were always granted access, without applying authentication\nchecks. The URIMappingInterceptor is a legacy mechanism for allowing\nREST-like access (via GET requests) to simple SOAP services. A remote\nattacker could use this flaw to access the REST-like interface of a simple\nSOAP service using GET requests that bypass the security constraints\napplied by WSS4JInInterceptor. This flaw was only exploitable if\nWSS4JInInterceptor was used to apply WS-Security processing. Services that\nuse WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633)\n\nWarning: Before applying this update, back up your existing JBoss\nEnterprise Application Platform installation and deployed applications.\n\nAll users of JBoss Enterprise Application Platform 6.0.1 on Red Hat\nEnterprise Linux 5 and 6 are advised to upgrade to this updated package.\nThe JBoss server process must be restarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0644",
        "url": "https://access.redhat.com/errata/RHSA-2013:0644"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/security-advisories.html",
        "url": "http://cxf.apache.org/security-advisories.html"
      },
      {
        "category": "external",
        "summary": "889008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
      },
      {
        "category": "external",
        "summary": "905722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0644.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache-cxf security update",
    "tracking": {
      "current_release_date": "2026-01-28T22:54:20+00:00",
      "generator": {
        "date": "2026-01-28T22:54:20+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.16"
        }
      },
      "id": "RHSA-2013:0644",
      "initial_release_date": "2013-03-13T18:45:00+00:00",
      "revision_history": [
        {
          "date": "2013-03-13T18:45:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-03-13T18:49:09+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-01-28T22:54:20+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server",
                  "product_id": "5Server-JBEAP-6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server",
                  "product_id": "6Server-JBEAP-6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
                "product": {
                  "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
                  "product_id": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src",
                "product": {
                  "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src",
                  "product_id": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
                "product": {
                  "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
                  "product_id": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
                "product": {
                  "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
                  "product_id": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch as a component of Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch"
        },
        "product_reference": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
        "relates_to_product_reference": "5Server-JBEAP-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src as a component of Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server",
          "product_id": "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src"
        },
        "product_reference": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
        "relates_to_product_reference": "5Server-JBEAP-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch"
        },
        "product_reference": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
        "relates_to_product_reference": "6Server-JBEAP-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server",
          "product_id": "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
        },
        "product_reference": "apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src",
        "relates_to_product_reference": "6Server-JBEAP-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5633",
      "discovery_date": "2012-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "889008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
          "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
          "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
          "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "RHBZ#889008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-13T18:45:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0644"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor"
    },
    {
      "cve": "CVE-2013-0239",
      "discovery_date": "2013-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "905722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
          "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
          "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
          "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "RHBZ#905722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0239",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-13T18:45:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0644"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.noarch",
            "5Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el5.src",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.noarch",
            "6Server-JBEAP-6:apache-cxf-0:2.4.9-6.redhat_3.ep6.el6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache CXF component of JBoss Enterprise Application\nPlatform 6.0.1 which fixes two security issues is now available from the\nRed Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache CXF is an open source services framework.\n\nIt was found that the Apache CXF UsernameTokenPolicyValidator and\nUsernameTokenInterceptor allowed a UsernameToken element with no password\nchild element to bypass authentication. A remote attacker could use this\nflaw to circumvent access controls applied to web services by omitting the\npassword in a UsernameToken. This flaw was exploitable on web services that\nrely on WS-SecurityPolicy plain text UsernameTokens to authenticate users.\nIt was not exploitable when using hashed passwords or WS-Security without\nWS-SecurityPolicy. (CVE-2013-0239)\n\nIf web services were deployed using Apache CXF with the WSS4JInInterceptor\nenabled to apply WS-Security processing, HTTP GET requests to these\nservices were always granted access, without applying authentication\nchecks. The URIMappingInterceptor is a legacy mechanism for allowing\nREST-like access (via GET requests) to simple SOAP services. A remote\nattacker could use this flaw to access the REST-like interface of a simple\nSOAP service using GET requests that bypass the security constraints\napplied by WSS4JInInterceptor. This flaw was only exploitable if\nWSS4JInInterceptor was used to apply WS-Security processing. Services that\nuse WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633)\n\nWarning: Before applying this update, back up your existing JBoss\nEnterprise Application Platform installation and deployed applications.\n\nAll users of JBoss Enterprise Application Platform 6.0.1 as provided from\nthe Red Hat Customer Portal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0645",
        "url": "https://access.redhat.com/errata/RHSA-2013:0645"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.0.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform\u0026downloadType=securityPatches\u0026version=6.0.1"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/security-advisories.html",
        "url": "http://cxf.apache.org/security-advisories.html"
      },
      {
        "category": "external",
        "summary": "889008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
      },
      {
        "category": "external",
        "summary": "905722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0645.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache-cxf security update",
    "tracking": {
      "current_release_date": "2024-11-22T06:20:53+00:00",
      "generator": {
        "date": "2024-11-22T06:20:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:0645",
      "initial_release_date": "2013-03-13T18:43:00+00:00",
      "revision_history": [
        {
          "date": "2013-03-13T18:43:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:45:50+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T06:20:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 6.0",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 6.0",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.0.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5633",
      "discovery_date": "2012-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "889008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "RHBZ#889008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-13T18:43:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Enterprise Application Platform installation and deployed\napplications.\n\nThe JBoss server process must be restarted for this update to take effect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0645"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor"
    },
    {
      "cve": "CVE-2013-0239",
      "discovery_date": "2013-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "905722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "RHBZ#905722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0239",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-03-13T18:43:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying this update, back up your\nexisting JBoss Enterprise Application Platform installation and deployed\napplications.\n\nThe JBoss server process must be restarted for this update to take effect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0645"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache CXF component of JBoss Portal Platform 6.0.0 which\nfixes two security issues is now available from the Red Hat Customer\nPortal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache CXF is an open source services framework.\n\nIt was found that the Apache CXF UsernameTokenPolicyValidator and\nUsernameTokenInterceptor allowed a UsernameToken element with no password\nchild element to bypass authentication. A remote attacker could use this\nflaw to circumvent access controls applied to web services by omitting the\npassword in a UsernameToken. This flaw was exploitable on web services that\nrely on WS-SecurityPolicy plain text UsernameTokens to authenticate users.\nIt was not exploitable when using hashed passwords or WS-Security without\nWS-SecurityPolicy. (CVE-2013-0239)\n\nIf web services were deployed using Apache CXF with the WSS4JInInterceptor\nenabled to apply WS-Security processing, HTTP GET requests to these\nservices were always granted access, without applying authentication\nchecks. The URIMappingInterceptor is a legacy mechanism for allowing\nREST-like access (via GET requests) to simple SOAP services. A remote\nattacker could use this flaw to access the REST-like interface of a simple\nSOAP service using GET requests that bypass the security constraints\napplied by WSS4JInInterceptor. This flaw was only exploitable if\nWSS4JInInterceptor was used to apply WS-Security processing. Services that\nuse WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633)\n\nWarning: Before applying this update, back up all applications deployed on\nJBoss Portal Platform, along with all customized configuration files, and\nany databases and database settings.\n\nAll users of JBoss Portal Platform 6.0.0 as provided from the Red Hat\nCustomer Portal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0749",
        "url": "https://access.redhat.com/errata/RHSA-2013:0749"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/security-advisories.html",
        "url": "http://cxf.apache.org/security-advisories.html"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jbportal\u0026version=6.0.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jbportal\u0026version=6.0.0"
      },
      {
        "category": "external",
        "summary": "889008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
      },
      {
        "category": "external",
        "summary": "905722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0749.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache-cxf security update",
    "tracking": {
      "current_release_date": "2024-11-22T06:20:43+00:00",
      "generator": {
        "date": "2024-11-22T06:20:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:0749",
      "initial_release_date": "2013-04-16T18:51:00+00:00",
      "revision_history": [
        {
          "date": "2013-04-16T18:51:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-04-16T18:53:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T06:20:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Portal 6.0",
                "product": {
                  "name": "Red Hat JBoss Portal 6.0",
                  "product_id": "Red Hat JBoss Portal 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5633",
      "discovery_date": "2012-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "889008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "RHBZ#889008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-04-16T18:51:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Portal Platform, along with all customized\nconfiguration files, and any databases and database settings.\n\nNote that it is recommended to halt the JBoss Portal Platform server by\nstopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the JBoss Portal\nPlatform server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss Portal 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0749"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor"
    },
    {
      "cve": "CVE-2013-0239",
      "discovery_date": "2013-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "905722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "RHBZ#905722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0239",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-04-16T18:51:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Portal Platform, along with all customized\nconfiguration files, and any databases and database settings.\n\nNote that it is recommended to halt the JBoss Portal Platform server by\nstopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the JBoss Portal\nPlatform server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss Portal 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0749"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache CXF component of JBoss Portal Platform 6.0.0 which\nfixes two security issues is now available from the Red Hat Customer\nPortal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache CXF is an open source services framework.\n\nIt was found that the Apache CXF UsernameTokenPolicyValidator and\nUsernameTokenInterceptor allowed a UsernameToken element with no password\nchild element to bypass authentication. A remote attacker could use this\nflaw to circumvent access controls applied to web services by omitting the\npassword in a UsernameToken. This flaw was exploitable on web services that\nrely on WS-SecurityPolicy plain text UsernameTokens to authenticate users.\nIt was not exploitable when using hashed passwords or WS-Security without\nWS-SecurityPolicy. (CVE-2013-0239)\n\nIf web services were deployed using Apache CXF with the WSS4JInInterceptor\nenabled to apply WS-Security processing, HTTP GET requests to these\nservices were always granted access, without applying authentication\nchecks. The URIMappingInterceptor is a legacy mechanism for allowing\nREST-like access (via GET requests) to simple SOAP services. A remote\nattacker could use this flaw to access the REST-like interface of a simple\nSOAP service using GET requests that bypass the security constraints\napplied by WSS4JInInterceptor. This flaw was only exploitable if\nWSS4JInInterceptor was used to apply WS-Security processing. Services that\nuse WS-SecurityPolicy to apply security were not affected. (CVE-2012-5633)\n\nWarning: Before applying this update, back up all applications deployed on\nJBoss Portal Platform, along with all customized configuration files, and\nany databases and database settings.\n\nAll users of JBoss Portal Platform 6.0.0 as provided from the Red Hat\nCustomer Portal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:0749",
        "url": "https://access.redhat.com/errata/RHSA-2013:0749"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://cxf.apache.org/security-advisories.html",
        "url": "http://cxf.apache.org/security-advisories.html"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jbportal\u0026version=6.0.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=jbportal\u0026version=6.0.0"
      },
      {
        "category": "external",
        "summary": "889008",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
      },
      {
        "category": "external",
        "summary": "905722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0749.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache-cxf security update",
    "tracking": {
      "current_release_date": "2026-01-28T22:54:23+00:00",
      "generator": {
        "date": "2026-01-28T22:54:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.16"
        }
      },
      "id": "RHSA-2013:0749",
      "initial_release_date": "2013-04-16T18:51:00+00:00",
      "revision_history": [
        {
          "date": "2013-04-16T18:51:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-04-16T18:53:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-01-28T22:54:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Portal 6.0",
                "product": {
                  "name": "Red Hat JBoss Portal 6.0",
                  "product_id": "Red Hat JBoss Portal 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Middleware"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5633",
      "discovery_date": "2012-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "889008"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "RHBZ#889008",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889008"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5633",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5633"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5633"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-04-16T18:51:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Portal Platform, along with all customized\nconfiguration files, and any databases and database settings.\n\nNote that it is recommended to halt the JBoss Portal Platform server by\nstopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the JBoss Portal\nPlatform server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss Portal 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0749"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor"
    },
    {
      "cve": "CVE-2013-0239",
      "discovery_date": "2013-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "905722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "RHBZ#905722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=905722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0239",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-0239"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239"
        }
      ],
      "release_date": "2013-02-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-04-16T18:51:00+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on JBoss Portal Platform, along with all customized\nconfiguration files, and any databases and database settings.\n\nNote that it is recommended to halt the JBoss Portal Platform server by\nstopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the JBoss Portal\nPlatform server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss Portal 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:0749"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "15691F9A-39D8-4228-83CF-96E98018012D",
              "versionEndIncluding": "2.5.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "617F940F-8B29-447D-BB6D-A1F4A151D87A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E1EE45D-2FAF-4FEE-9FD6-DBD695C9A6A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4BB8072-24DC-490A-9DCB-A4B6A694541C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "19233D8E-661D-454C-8504-77228B2249BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "D97DFFE5-8E06-4A59-9971-8FCF2B969025",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD8E746D-8FEF-47AB-97DC-8A0C1743F7D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BFB2300-841A-4D92-96C7-D58E15F67D8E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6468310-155B-4582-9DA8-90C6B99E02BF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D24246B2-915D-494B-9863-CF0B662BE54D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6915B2EC-AA31-44B5-A5F3-3EE1FDD0ABC7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "90280778-F7D6-49E2-9C7F-9F5F58137FDE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "962F2A85-4731-450B-986B-E1A79986F143",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "49F920D4-1102-4D30-ABD8-F47342DA735A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "84FD5387-E292-458A-9E8C-85C082461594",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D523A5E-24A7-43D7-AE54-02EBF13537D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.5.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC774B3E-D7E4-4FC1-AB09-392EC16F0F76",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4FC7D67-80A3-43F6-8D46-F13F37A017CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F069B04-FDA0-41C3-BCAC-C74A310078B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "EED986C6-39C6-4F2A-86F7-C2CE9BBE25B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE5CF2CB-B33D-4C51-84C3-8C10E3E26193",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BACD3A8-2FEE-4CB7-9229-06679D6D8150",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "0835933D-4EA4-4C95-8964-984087537268",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C629A8A7-BFB3-453B-9BCA-3873512410FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "346AF04F-E0C5-45EE-A421-2E1A4E2B57FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "29777E8F-4DB3-4E9E-9FF4-D13749A7C0AE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element."
    },
    {
      "lang": "es",
      "value": "Apache CXF anterior a v2.5.9, v2.6.x anterior a v2.6.6, y v2.7.x anterior a v2.7.3, cuando est\u00e1 activado sernameToken WS-SecurityPolicy en texto plano, permite a atacantes remotos evitar la autenticaci\u00f3n a trav\u00e9s de una cabecera de seguridad de una petici\u00f3n SOAP que contiene un elemento UsernameToken que carece de contrase\u00f1a en el elemento hijo."
    }
  ],
  "id": "CVE-2013-0239",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2013-03-12T23:55:01.690",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cxf.apache.org/cve-2013-0239.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/90078"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0749.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://seclists.org/fulldisclosure/2013/Feb/39"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/51988"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1438424"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/57876"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81981"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cxf.apache.org/cve-2013-0239.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/90078"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0749.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2013/Feb/39"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/51988"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1438424"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/57876"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81981"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2013-0239",
    "description": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
    "id": "GSD-2013-0239",
    "references": [
      "https://access.redhat.com/errata/RHSA-2013:0749",
      "https://access.redhat.com/errata/RHSA-2013:0649",
      "https://access.redhat.com/errata/RHSA-2013:0645",
      "https://access.redhat.com/errata/RHSA-2013:0644"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2013-0239"
      ],
      "details": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
      "id": "GSD-2013-0239",
      "modified": "2023-12-13T01:22:14.805416Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2013-0239",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2013-0749.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0749.html"
          },
          {
            "name": "http://seclists.org/fulldisclosure/2013/Feb/39",
            "refsource": "MISC",
            "url": "http://seclists.org/fulldisclosure/2013/Feb/39"
          },
          {
            "name": "http://secunia.com/advisories/51988",
            "refsource": "MISC",
            "url": "http://secunia.com/advisories/51988"
          },
          {
            "name": "http://cxf.apache.org/cve-2013-0239.html",
            "refsource": "MISC",
            "url": "http://cxf.apache.org/cve-2013-0239.html"
          },
          {
            "name": "http://osvdb.org/90078",
            "refsource": "MISC",
            "url": "http://osvdb.org/90078"
          },
          {
            "name": "http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html"
          },
          {
            "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1438424",
            "refsource": "MISC",
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1438424"
          },
          {
            "name": "http://www.securityfocus.com/bid/57876",
            "refsource": "MISC",
            "url": "http://www.securityfocus.com/bid/57876"
          },
          {
            "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81981",
            "refsource": "MISC",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81981"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,2.5.9),[2.6.0,2.6.6),[2.7.0,2.7.3)",
          "affected_versions": "All versions before 2.5.9, all versions starting from 2.6.0 before 2.6.6, all versions starting from 2.7.0 before 2.7.3",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-287",
            "CWE-937"
          ],
          "date": "2022-07-08",
          "description": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "fixed_versions": [
            "2.5.9",
            "2.6.6",
            "2.7.3"
          ],
          "identifier": "CVE-2013-0239",
          "identifiers": [
            "GHSA-p5c5-6564-vvr8",
            "CVE-2013-0239"
          ],
          "not_impacted": "All versions starting from 2.5.9 before 2.6.0, all versions starting from 2.6.6 before 2.7.0, all versions starting from 2.7.3",
          "package_slug": "maven/org.apache.cxf/cxf-rt-frontend-jaxrs",
          "pubdate": "2022-05-05",
          "solution": "Upgrade to versions 2.5.9, 2.6.6, 2.7.3 or above.",
          "title": "Improper Authentication",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2013-0239",
            "https://exchange.xforce.ibmcloud.com/vulnerabilities/81981",
            "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E",
            "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E",
            "http://cxf.apache.org/cve-2013-0239.html",
            "http://osvdb.org/90078",
            "http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html",
            "http://rhn.redhat.com/errata/RHSA-2013-0749.html",
            "http://seclists.org/fulldisclosure/2013/Feb/39",
            "http://secunia.com/advisories/51988",
            "http://svn.apache.org/viewvc?view=revision\u0026revision=1438424",
            "https://github.com/advisories/GHSA-p5c5-6564-vvr8"
          ],
          "uuid": "87be13f2-07f5-401f-84d1-687c2aa5b3c5"
        },
        {
          "affected_range": "[2.4.1,2.5.9),[2.6.0,2.6.6),[2.7.0,2.7.3)",
          "affected_versions": "All versions starting from 2.4.1 before 2.5.9, all versions starting from 2.6.0 before 2.6.6, all versions staring from 2.7.0 before 2.7.3.",
          "cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-287",
            "CWE-937"
          ],
          "date": "2017-08-28",
          "description": "When the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
          "fixed_versions": [
            "2.5.9",
            "2.6.6",
            "2.7.3"
          ],
          "identifier": "CVE-2013-0239",
          "identifiers": [
            "CVE-2013-0239"
          ],
          "package_slug": "maven/org.apache.cxf/cxf-rt-ws-security",
          "pubdate": "2013-03-12",
          "solution": "Upgrade to version 2.5.9, 2.6.6, 2.7.3 and above.",
          "title": "UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate",
          "urls": [
            "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0239"
          ],
          "uuid": "60a31b9b-26d0-4b2c-8ecd-b45a63046c40"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.5.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.4.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.5.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.5.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.5.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.5.8",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.5.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.4.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.4.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.5.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-0239"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-287"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "57876",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/57876"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1438424",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1438424"
            },
            {
              "name": "http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html",
              "refsource": "MISC",
              "tags": [],
              "url": "http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html"
            },
            {
              "name": "http://cxf.apache.org/cve-2013-0239.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://cxf.apache.org/cve-2013-0239.html"
            },
            {
              "name": "51988",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/51988"
            },
            {
              "name": "20130208 New security advisories for Apache CXF",
              "refsource": "FULLDISC",
              "tags": [],
              "url": "http://seclists.org/fulldisclosure/2013/Feb/39"
            },
            {
              "name": "90078",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/90078"
            },
            {
              "name": "RHSA-2013:0749",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0749.html"
            },
            {
              "name": "apachecxf-username-tokens-sec-bypass(81981)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81981"
            },
            {
              "name": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E",
              "refsource": "MISC",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E",
              "refsource": "MISC",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E",
              "refsource": "MISC",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E",
              "refsource": "MISC",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E",
              "refsource": "MISC",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E",
              "refsource": "MISC",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2023-02-13T04:39Z",
      "publishedDate": "2013-03-12T23:55Z"
    }
  }
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cxf:cxf-rt-frontend-jaxrs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cxf:cxf-rt-frontend-jaxrs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "2.6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.cxf:cxf-rt-frontend-jaxrs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2013-0239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-08T18:58:53Z",
    "nvd_published_at": "2013-03-12T23:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.",
  "id": "GHSA-p5c5-6564-vvr8",
  "modified": "2023-12-21T21:11:21Z",
  "published": "2022-05-05T02:48:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0239"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/cxf/commit/e4c6b3b0899ef2ba87c2610efc323b71c13dd421"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20200229102616/http://www.securityfocus.com/bid/57876"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/cxf"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81981"
    },
    {
      "type": "WEB",
      "url": "http://cxf.apache.org/cve-2013-0239.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0749.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2013/Feb/39"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1438424"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Improper Authentication in Apache CXF"
}