CVE-2025-48913

Published: Aug 8, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.

Affected (3)

Products: Apache: Cxf

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Before 3.6.8
Apache Cxf	From 4.0.0 to 4.0.9
Apache Cxf	From 4.1.0 to 4.1.3

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2025/08/07/2

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.