CVE-2013-2160: Medium severity apache cxf vulnerability
Multiple denial of service flaws were found in the way StAX parser implementation of Apache CXF, an open-source web services framework, performed processing of certain XML files. If a web service application utilized the services of the StAX parser, a remote attacker could provide a specially-crafted XML file that, when processed by the application would lead to excessive system resources (CPU cycles, memory) consumption by that application.
References: [1] http://jira.codehaus.org/browse/WSTX-287 [2] http://jira.codehaus.org/browse/WSTX-285
Other sources
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2160?
CVE-2013-2160 is classified as a denial-of-service vulnerability that can potentially disrupt service availability.
How do I fix CVE-2013-2160?
To fix CVE-2013-2160, upgrade Apache CXF to version 2.5.10, 2.6.7, or 2.7.4 or later.
What versions of Apache CXF are affected by CVE-2013-2160?
CVE-2013-2160 affects Apache CXF versions 2.5.0 through 2.7.3.
Can CVE-2013-2160 be exploited remotely?
Yes, a remote attacker can exploit CVE-2013-2160 by providing specially crafted XML files.
What impact does CVE-2013-2160 have on web service applications?
CVE-2013-2160 can cause a denial of service, leading to unresponsive web service applications that utilize the StAX parser.