Vulnerability Database

296,746

Total vulnerabilities in the database

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

CVSS v3:

  • Severity: Medium
  • Score: 5.3
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
apache / cxf 3.0.0 3.0.13.x
apache / cxf 3.1.0 3.1.11.x
Maven icon org.apache.cxf / cxf-core 3.1.0 3.1.11
Maven icon org.apache.cxf / cxf-core - 3.0.13