Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spo

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache CXF

  • prior to 3.0.13affected
  • 3.1.x prior to 3.1.11affected

References