CVE-2012-2379

critical Apache
CVSS v3 Base Score
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS Score
3.8%
Exploitation probability in 30 days
Top 12% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Confidentiality
C
Integrity
C
Availability
C
Published: January 3, 2013 (4880 days ago)
Last Modified: April 29, 2026
Vendor: Apache
Source: NVD

Description

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.

CWE

NVD-CWE-noinfo

Affected Products

apache cxf

References

🔗 cxf.apache.org 🔗 rhn.redhat.com 🔗 rhn.redhat.com 🔗 rhn.redhat.com 🔗 rhn.redhat.com