Unscored severity · published Aug 19, 2013
CVE-2012-5575
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy…
–
CVSS
6.3%
EPSS
No
On KEV
Description
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
Exploitation
Is it being used?
Exploit prediction (EPSS)6.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cxf · Apache
2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +15 more · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
5.0.0 · source: NVD
JE
Jboss Enterprise Portal Platform · Redhat
4.3.0 · source: NVD
JE
Jboss Enterprise Soa Platform · Redhat
4.3.0 · source: NVD
JE
Jboss Enterprise Web Platform · Redhat
5.2.0 · source: NVD
JF
Jboss Fuse Esb Enterprise · Redhat
7.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5575
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5575
cxf.apache.org
http://cxf.apache.org/cve-2012-5575.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0833.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0834.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0839.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0873.html
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0874.html
More from Cxf
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository