CVE-2012-2378
apache cxf: no CVSS score yet. EPSS 3.9% chance of exploitation in the next 30 days. Fixed in org.apache.cxf:cxf 2.4.8, 2.5.3, 2.6.1.
Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
- EPSS
- 3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vjpc-vf4f-82qg | Maven | org.apache.cxf:cxf | >=2.4.5 <2.4.8 | 2.4.8 |
| GHSA-vjpc-vf4f-82qg | Maven | org.apache.cxf:cxf | >=2.5.1 <2.5.3 | 2.5.3 |
| GHSA-vjpc-vf4f-82qg | Maven | org.apache.cxf:cxf | >=2.6.0 <2.6.1 | 2.6.1 |