Search for vulnerabilities
Vulnerability details: VCID-kahc-rzzq-c7ev
Vulnerability ID VCID-kahc-rzzq-c7ev
Aliases CVE-2013-2160
GHSA-254q-rp36-v2m8
Summary Missing XML Validation in Apache CXF The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.
Status Published
Exploitability 2.0
Weighted Severity 6.2
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-112 Missing XML Validation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-399 Resource Management Errors
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual MODERATE http://jira.codehaus.org/browse/WSTX-285
generic_textual MODERATE http://jira.codehaus.org/browse/WSTX-287
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-1028.html
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-1437.html
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
epss 0.203 https://api.first.org/data/v1/epss?cve=CVE-2013-2160
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=929197
generic_textual MODERATE https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-254q-rp36-v2m8
generic_textual MODERATE https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2013-2160
Reference id Reference type URL
http://jira.codehaus.org/browse/WSTX-285
http://jira.codehaus.org/browse/WSTX-287
http://rhn.redhat.com/errata/RHSA-2013-1028.html
http://rhn.redhat.com/errata/RHSA-2013-1437.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-2160.json
https://api.first.org/data/v1/epss?cve=CVE-2013-2160
https://bugzilla.redhat.com/show_bug.cgi?id=929197
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2160
https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc
https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2013-2160
CVE-2013-2160;OSVDB-95011 Exploit http://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc
CVE-2013-2160;OSVDB-95011 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/dos/26710.txt
GHSA-254q-rp36-v2m8 https://github.com/advisories/GHSA-254q-rp36-v2m8
RHSA-2013:1028 https://access.redhat.com/errata/RHSA-2013:1028
RHSA-2013:1185 https://access.redhat.com/errata/RHSA-2013:1185
RHSA-2013:1437 https://access.redhat.com/errata/RHSA-2013:1437
Data source Exploit-DB
Date added July 9, 2013
Description Apache CXF < 2.5.10/2.6.7/2.7.4 - Denial of Service
Ransomware campaign use Known
Source publication date July 9, 2013
Exploit type dos
Platform multiple
Source update date July 9, 2013
Source URL http://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc
Exploit Prediction Scoring System (EPSS)
Percentile 0.95276
EPSS Score 0.203
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:05:49.061346+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-254q-rp36-v2m8/GHSA-254q-rp36-v2m8.json 37.0.0