CVE-2019-12406
Medium
Description
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
SeverityMedium
CVSS6.5
Exploit probability—
Product
Apache Cxf
PublishedNov 6, 2019
First seenNov 6, 2019
How to fix
Update
- apache cxf3.2.11, 3.3.4 or later
- org.apache.cxf:cxf3.2.11, 3.3.4 or later
- org.apache.cxf:apache-cxf3.2.11, 3.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cxf | v < 3.2.11, 3.3.0 ≤ v < 3.3.4 | 3.2.11, 3.3.4 |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle flexcube_private_banking | 12.0.0, 12.1.0 | — |
| oracle retail_order_broker | 15.0 | — |
| org.apache.cxf:cxfMaven | v < 3.2.11, 3.3.0 ≤ v < 3.3.4 | 3.2.11, 3.3.4 |
| org.apache.cxf:apache-cxfMaven | v < 3.2.11, 3.3.0 ≤ v < 3.3.4 | 3.2.11, 3.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.