CVE-2010-2076

moderate-risk
Published 2010-08-19

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.

Do I need to act?

!
12.0% chance of exploitation in next 30 days
EPSS score — higher than 88% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Cxf

Affected Vendors

Apache

References (32)

Vendor Advisory http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
Release Notes http://geronimo.apache.org/21x-security-report.html
Release Notes http://geronimo.apache.org/22x-security-report.html
Broken Link http://secunia.com/advisories/40969
Broken Link http://secunia.com/advisories/41016
Broken Link http://secunia.com/advisories/41025
Exploit http://svn.apache.org/repos/asf/cxf/trunk/security/CVE-2010-2076.pdf
Broken Link http://www.listware.net/201006/cxf-users/60160-important-apache-cxf-security-adv...
Broken Link http://www.securityfocus.com/bid/42492
Third Party Advisory https://issues.apache.org/jira/browse/GERONIMO-5383
Mailing List https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de10...
Mailing List https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b...
Mailing List https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fd...
Mailing List https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba7...
Mailing List https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49...
Mailing List https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a7...
Vendor Advisory http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html
Release Notes http://geronimo.apache.org/21x-security-report.html
Release Notes http://geronimo.apache.org/22x-security-report.html
Broken Link http://secunia.com/advisories/40969
and 12 more references
49
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 12/34 · Low
Exposure 5/34 · Minimal