Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache CXF输入验证错误漏洞
Vulnerability Description
Apache CXF是美国阿帕奇（Apache）软件基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。Apache CXF没有正确限制XML文档类型声明(DTD)的处理，攻击者可以利用漏洞判断文件是否存在或包含本地文件内容，如果攻击者提供大量嵌套的DTD可消耗大量CPU和内存，造成拒绝服务攻击。
CVSS Information
N/A
Vulnerability Type
N/A