Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

CVSS v3:

  • Severity: Medium
  • Score: 5.3
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
apache / cxf 3.0.0 3.0.13.x
apache / cxf 3.1.0 3.1.11.x
org.apache.cxf / cxf-core 3.1.0 3.1.11
org.apache.cxf / cxf-core - 3.0.13