Unscored severity · published Mar 12, 2013
CVE-2012-5633
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows…
–
CVSS
8.2%
EPSS
No
On KEV
Description
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.2% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cxf · Apache
through 2.5.7; 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5633
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5633
Vendor Advisory
http://cxf.apache.org/cve-2012-5633.html
osvdb.org
http://osvdb.org/90079
packetstormsecurity.com
http://packetstormsecurity.com/files/120213/Apache-CXF-WS-Security-URIMappingInterceptor-Bypass.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0256.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0257.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0258.html
More from Cxf
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository