CVE-2013-0239: Medium severity apache cxf vulnerability
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0239?
CVE-2013-0239 has a moderate severity due to its ability to allow remote attackers to bypass authentication.
How do I fix CVE-2013-0239?
To fix CVE-2013-0239, upgrade Apache CXF to version 2.5.9, 2.6.6, or 2.7.3 or later.
What versions of Apache CXF are affected by CVE-2013-0239?
CVE-2013-0239 affects Apache CXF versions before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3.
What type of attack can CVE-2013-0239 facilitate?
CVE-2013-0239 can facilitate authentication bypass through manipulation of UsernameToken elements in SOAP requests.
Is CVE-2013-0239 a remote vulnerability?
Yes, CVE-2013-0239 is a remote vulnerability that allows attackers to exploit it over the network.