The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cxf | Apache | * | 2.5.7 (including) |
| Cxf | Apache | 2.5.0 (including) | 2.5.0 (including) |
| Cxf | Apache | 2.5.1 (including) | 2.5.1 (including) |
| Cxf | Apache | 2.5.2 (including) | 2.5.2 (including) |
| Cxf | Apache | 2.5.3 (including) | 2.5.3 (including) |
| Cxf | Apache | 2.5.4 (including) | 2.5.4 (including) |
| Cxf | Apache | 2.5.5 (including) | 2.5.5 (including) |
| Cxf | Apache | 2.5.6 (including) | 2.5.6 (including) |
| Fuse ESB Enterprise 7.1.0 | RedHat | * | |
| JBEWP 5 for RHEL 5 | RedHat | apache-cxf-0:2.2.12-10.patch_06.ep5.el5 | * |
| JBEWP 5 for RHEL 6 | RedHat | apache-cxf-0:2.2.12-10.patch_06.ep5.el6 | * |
| JBoss Enterprise BRMS Platform 5.3 | RedHat | * | |
| Red Hat JBoss Enterprise Application Platform 5.2 | RedHat | * | |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 | RedHat | apache-cxf-0:2.2.12-10.patch_06.ep5.el4 | * |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 | RedHat | apache-cxf-0:2.2.12-10.patch_06.ep5.el5 | * |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 | RedHat | apache-cxf-0:2.2.12-10.patch_06.ep5.el6 | * |
| Red Hat JBoss Enterprise Application Platform 6.0 | RedHat | * | |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 | RedHat | apache-cxf-0:2.4.9-6.redhat_3.ep6.el5 | * |
| Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 | RedHat | apache-cxf-0:2.4.9-6.redhat_3.ep6.el6 | * |
| Red Hat JBoss Portal 6.0 | RedHat | * | |
| Red Hat JBoss SOA Platform 5.3 | RedHat | * | |
| Red Hat JBoss Web Platform 5.2 | RedHat | * |