CVE-2012-3451

Home/CVE/Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-se

CVE

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-se

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.

MEDIUM · CVSS 4.3 EPSS 0.09969

Monitor

EPSS percentile: top 7% of all CVEs by exploitation likelihood

Sigma rules0 YARA rules0

⬡

Weakness Classification

CWE-20Improper Input Validation

▤

Affected Products & Versions

apache cxf< 2.4.9
apache cxf>= 2.5.0 and < 2.5.5
apache cxf>= 2.6.0 and < 2.6.2

▤

Affected Packages

Language-ecosystem packages (from OSV) tied to this CVE, with the version that fixes it - the dependency-level detail NVD doesn’t carry.

Maven org.apache.cxf:cxf HIGH fixed in 2.4.9

▣

Scoring & Timeline

4.3

MEDIUM · CVSS v2 (legacy) · secalert@redhat.com

View on NVD

This CVE predates CVSS v3; the legacy v2 score is shown so triage still has a severity to work with.

v2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Published to NVD24 Sep 2012 · 05:55 PM

⚑

Vendor Advisories

rhsaRHSA-2013:0726Important
rhsaRHSA-2013:0258Important
rhsaRHSA-2013:0257Important
rhsaRHSA-2013:0259Important
rhsaRHSA-2013:0743Important
Show all 9 vendor advisoriesrhsaRHSA-2013:0256Important
rhsaRHSA-2012:1591Moderate
rhsaRHSA-2012:1592Moderate
rhsaRHSA-2012:1594Moderate

🔗

References & Sources

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

http://cxf.apache.org/cve-2012-3451.htmlVendor Advisory

http://rhn.redhat.com/errata/RHSA-2012-1591.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2012-1592.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2012-1594.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0256.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0257.htmlThird Party Advisory

Show all 21 references

http://rhn.redhat.com/errata/RHSA-2013-0258.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0259.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0726.htmlThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0743.htmlThird Party Advisory

http://secunia.com/advisories/51607Third Party Advisory

http://secunia.com/advisories/52183Third Party Advisory

http://svn.apache.org/viewvc?view=revision&revision=1368559PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=851896Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/78734Third Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin