[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAB8XdGDoLmyhDdcjpSg9bSAqAXx1OPH-_R9i60tGCy0xDH37LQ@mail.gmail.com>
Date: Thu, 7 Aug 2025 16:54:23 +0100
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE
Severity: moderate
Affected versions:
- Apache CXF 4.1.0 before 4.1.3
- Apache CXF 4.0.0 before 4.0.9
- Apache CXF before 3.6.8
Description:
If untrusted users are allowed to configure JMS for Apache CXF,
previously they could use RMI or LDAP URLs, potentially leading to
code execution capabilities. This interface is now restricted to
reject those protocols, removing this possibility.
Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3,
which fix this issue.
Credit:
M Bhatt (r34p3r) OWASP GenAI Security Project & Blake Gatto (b1oo)
Shrewd Research (finder)
References:
https://cxf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-48913
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
