CVE-2013-0239

Published: Mar 12, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

Affected (26)

Products: Apache: Cxf

1 product

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Up to 2.5.8
Apache Cxf	Version 2.4.0
Apache Cxf	Version 2.4.1
Apache Cxf	Version 2.4.2
Apache Cxf	Version 2.4.3
Apache Cxf	Version 2.4.4
Apache Cxf	Version 2.4.5
Apache Cxf	Version 2.4.6
Apache Cxf	Version 2.4.7
Apache Cxf	Version 2.5.0
Apache Cxf	Version 2.5.1
Apache Cxf	Version 2.5.2
Apache Cxf	Version 2.5.3
Apache Cxf	Version 2.5.4
Apache Cxf	Version 2.5.5
Apache Cxf	Version 2.5.6
Apache Cxf	Version 2.5.7

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Version 2.6.0
Apache Cxf	Version 2.6.1
Apache Cxf	Version 2.6.2
Apache Cxf	Version 2.6.3
Apache Cxf	Version 2.6.4
Apache Cxf	Version 2.6.5

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Version 2.7.0
Apache Cxf	Version 2.7.1
Apache Cxf	Version 2.7.2

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (30)

http://cxf.apache.org/cve-2013-0239.html

Source: secalert@redhat.com

Vendor Advisory

http://osvdb.org/90078

Source: secalert@redhat.com

http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0749.html

Source: secalert@redhat.com

http://seclists.org/fulldisclosure/2013/Feb/39

Source: secalert@redhat.com

http://secunia.com/advisories/51988

Source: secalert@redhat.com

Vendor Advisory

http://svn.apache.org/viewvc?view=revision&revision=1438424

Source: secalert@redhat.com

Patch

http://www.securityfocus.com/bid/57876

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/81981

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

http://cxf.apache.org/cve-2013-0239.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://osvdb.org/90078

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0749.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2013/Feb/39

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/51988

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://svn.apache.org/viewvc?view=revision&revision=1438424

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/bid/57876

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/81981

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.