CVE-2012-2379
apache cxf: no CVSS score yet. EPSS 4.1% chance of exploitation in the next 30 days. Fixed in org.apache.cxf:cxf 2.4.8, 2.5.4, 2.6.1.
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
- EPSS
- 4.1% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2g99-c67p-56hm | Maven | org.apache.cxf:cxf | >=2.4.0 <2.4.8 | 2.4.8 |
| GHSA-2g99-c67p-56hm | Maven | org.apache.cxf:cxf | >=2.5.0 <2.5.4 | 2.5.4 |
| GHSA-2g99-c67p-56hm | Maven | org.apache.cxf:cxf | >=2.6.0 <2.6.1 | 2.6.1 |