CVE-2017-5653 Vulnerability Details

  /     /     /  

CVE-2017-5653 Metadata Quick Info

CVE Published: 18/04/2017 | CVE Updated: 05/08/2024 | CVE Year: 2017
Source: apache | Vendor: Apache Software Foundation | Product: Apache CXF
Status : PUBLISHED

---

CVE-2017-5653 Description

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: XML Security streaming clients do not validate that the service response was secured.
Source: Apache Software Foundation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).