Apache CXF CVE-2017-5653 Spoofing Vulnerability

Bugtraq ID:	97968
Class:	Design Error
CVE:	CVE-2017-5653
Remote:	Yes
Local:	No
Published:	Apr 18 2017 12:00AM
Updated:	May 02 2017 05:08AM
Credit:	The vendor reported this issue.
Vulnerable:	Apache Cxf 3.1.8 Apache Cxf 3.1.7 Apache Cxf 3.1.3 Apache Cxf 3.1.2 Apache Cxf 3.1.1 Apache Cxf 3.1 Apache Cxf 3.0.11 Apache Cxf 3.0.10 Apache Cxf 3.0.7 Apache Cxf 3.0.6 Apache Cxf 3.0.5 Apache Cxf 3.0.4 Apache Cxf 3.0.3 Apache Cxf 3.0.2 Apache Cxf 3.0.1
Not Vulnerable:	Apache Cxf 3.1.11

Apache CXF CVE-2017-5653 Spoofing Vulnerability

Apache CXF is prone to a spoofing vulnerability.

An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible.

The following versions are affected:

Apache CXF 3.0.x prior to 3.0.13
Apache CXF 3.1.x prior to 3.1.11

Apache CXF CVE-2017-5653 Spoofing Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: http://.

Apache CXF CVE-2017-5653 Spoofing Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache CXF CVE-2017-5653 Spoofing Vulnerability

References:

• Apache CXF Homepage (Apache Software Foundation)
  
• Apache Homepage (Apache)
  
• Finalizing XmlSecInInterceptor updates (Apache)
  
• CVE-2017-5653: Apache CXF JAX-RS XML Security streaming clients do not validate (Apache)