Vulnerability Database

309,134

Total vulnerabilities in the database

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
apache / cxf 3.0.0 3.0.13.x
apache / cxf 3.1.0 3.1.11.x
Maven icon org.apache.cxf / cxf-core 3.1.0 3.1.11
Maven icon org.apache.cxf / cxf-core - 3.0.13