CVE-2012-5633: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor

March 12, 2013 (updated August 28, 2017)

The URIMappingInterceptor in this package bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5633
github.com/apache/cxf/commit/db11c9115f31e171de4622149f157d8283f6c720

Code Behaviors & Features

Detect and mitigate CVE-2012-5633 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →