GHSA-2hvc-5c6v-f533: Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.1 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.6 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.11
Event History
Frequently Asked Questions
Who is exposed to this issue?
Apache CXF deployments are exposed if untrusted users are allowed to configure JMS. The affected path can provide code-execution capabilities through untrusted JMS configuration.
What access does an attacker need?
An attacker needs the ability to configure JMS for Apache CXF as an untrusted user. The supplied severity vector indicates network reachability, low privileges required, and no user interaction required.
Which versions contain the fix?
Upgrade Apache CXF to version 4.2.1, 4.1.6, or 3.6.11. These versions are identified as fixing this incomplete prior fix.