Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6?arch=el5
purl pkg:rpm/redhat/apache-cxf@2.4.9-6.redhat_3.ep6?arch=el5
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 3.1
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-6dpm-n1kk-5fer
Aliases:
CVE-2012-5633
GHSA-xf9f-32gh-h2w4
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request. There are no reported fixed by versions.
VCID-akr4-z7v7-9qbc
Aliases:
CVE-2013-0239
GHSA-p5c5-6564-vvr8
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T14:52:31.366739+00:00 RedHat Importer Affected by VCID-akr4-z7v7-9qbc https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-0239.json 38.0.0
2026-04-01T14:52:31.280546+00:00 RedHat Importer Affected by VCID-6dpm-n1kk-5fer https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-5633.json 38.0.0