FKIE_CVE-2016-6812
Vulnerability from fkie_nvd - Published: 2017-08-10 16:29 - Updated: 2025-04-20 01:37
Severity ?
Summary
The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "98F580FB-30CB-424C-B401-02DD90BC2265",
"versionEndIncluding": "3.0.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BFBBD3B0-C8AE-45BA-83A3-847F03E90319",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "52F66A01-83E5-48D8-AD1F-7F331CC889D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2A1BF056-AA31-4968-85C7-9897F5720325",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "EF05B313-65F0-4DD3-B6AC-0B4F6E39E677",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F0DA5338-6541-46CF-B8BC-BA41CF9C33CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "132F95AB-FF48-4434-A5E7-4EC7C801FAC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E74DDFC9-7DFB-4C60-B20D-274260481F1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "B0029085-6E5C-4502-967B-8CA47FDE39EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "69F2C5BA-4052-46F7-9AF4-BB87E7A8FFFC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client."
},
{
"lang": "es",
"value": "El m\u00f3dulo de transporte HTTP en Apache CXF anterior a su versi\u00f3n 3.0.12 y en versiones 3.1.x anteriores a 3.1.9 utiliza FormattedServiceListWriter para proporcionar una p\u00e1gina HTML que enumera los nombres y URL absolutas de endpoints de servicio disponibles. El m\u00f3dulo calcula la URL base empleando el HttpServletRequest actual. La URL base calculada es empleada por FormattedServiceListWritter para construir las URL absolutas de los endpoints de servicio. Si los par\u00e1metros matriz inesperados se han inyectado en la URL de petici\u00f3n, esos par\u00e1metros matriz volver\u00e1n al cliente en la p\u00e1gina de lista de servicios, lo que representa un riesgo de XSS para el cliente."
}
],
"id": "CVE-2016-6812",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-08-10T16:29:00.657",
"references": [
{
"source": "security@apache.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc"
},
{
"source": "security@apache.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97582"
},
{
"source": "security@apache.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1037543"
},
{
"source": "security@apache.org",
"url": "https://access.redhat.com/errata/RHSA-2017:0868"
},
{
"source": "security@apache.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.apache.org/jira/browse/CXF-6216"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "security@apache.org",
"url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97582"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1037543"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2017:0868"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.apache.org/jira/browse/CXF-6216"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E"
}
],
"sourceIdentifier": "security@apache.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…