cve.bz

CVE-2018-8038

7.5 highEPSS 11%

High (7.5) in apache cxf fediz. EPSS 11% chance of exploitation in the next 30 days. Fixed in org.apache.cxf.fediz:fediz-spring 1.4.4.

Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.

Severity

CVSS 3.0

7.5 high
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
11% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE
CWE-20
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-w3gh-g32m-cvhrMavenorg.apache.cxf.fediz:fediz-spring<1.4.41.4.4
GHSA-w3gh-g32m-cvhrMavenorg.apache.cxf.fediz:fediz-spring2<1.4.41.4.4
GHSA-w3gh-g32m-cvhrMavenorg.apache.cxf.fediz:fediz-spring3<1.4.41.4.4
GHSA-w3gh-g32m-cvhrMavenorg.apache.cxf.fediz:fediz-jetty8<1.4.41.4.4
GHSA-w3gh-g32m-cvhrMavenorg.apache.cxf.fediz:fediz-jetty9<1.4.41.4.4

References

Check your stackJSON