Unscored severity · published Sep 24, 2012
CVE-2012-3451
Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action…
–
CVSS
8.9%
EPSS
No
On KEV
Description
Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.9% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cxf · Apache
before 2.4.9; 2.5.0 before 2.5.5; 2.6.0 before 2.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3451
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3451
Vendor Advisory
http://cxf.apache.org/cve-2012-3451.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1591.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1592.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1594.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0256.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0257.html
More from Cxf
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository