Unscored severity · published Mar 12, 2013
CVE-2013-0239
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass…
–
CVSS
4.7%
EPSS
No
On KEV
Description
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cxf · Apache
through 2.5.8; 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0239
Vendor Advisory
http://cxf.apache.org/cve-2013-0239.html
osvdb.org
http://osvdb.org/90078
packetstormsecurity.com
http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0749.html
seclists.org
http://seclists.org/fulldisclosure/2013/Feb/39
Vendor Advisory
http://secunia.com/advisories/51988
More from Cxf
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository