CVE-2017-12624: apache software foundation apache cxf
Vulnerability summary
CVE-2017-12624 is a medium (CVSS 5.5) vulnerability in apache software foundation apache cxf. EPSS estimates a 3.70% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 14-11-2017PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.70%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.70% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Apache1 product
- cxf≥ 3.0.0, < 3.0.16 | ≥ 3.1.0, < 3.1.14 | ≥ 3.2.0, < 3.2.1
Apache software foundation1 product
- apache cxfprior to 3.1.14 | 3.2.x prior to 3.2.1
Org.apache.cxf1 product
- cxf-core≥ 3.2.0, < 3.2.1 | ≥ 3.1.0, < 3.1.14 | < 3.0.16
3 vendors · 3 products
References
25 links- cxf.apache.org/security-advisories.data/CVE-2017-12624.txt.ascX Refsource CONFIRMIssue TrackingVendor AdvisoryWEB
Show all 25 references
- github.com/apache/cxfPACKAGE