Unscored severity · published Jan 3, 2013
CVE-2012-2379
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure…
–
CVSS
4.1%
EPSS
No
On KEV
Description
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cxf · Apache
2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2379
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2379
Patch
http://cxf.apache.org/cve-2012-2379.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1559.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1573.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1591.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1592.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1593.html
More from Cxf
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository