Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache CXF WS-SecurityPolicy 授权问题漏洞
Vulnerability Description
Apache CXF是美国阿帕奇（Apache）软件基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。 Apache CXF 2.5.9之前版本，2.6.6之前的2.6.x版本，2.7.3之前的2.7.x版本中存在授权问题漏洞。当启用纯文本UsernameToken WS-SecurityPolicy时，通过包含缺少密码子元素的UsernameToken元素的SOAP请求的安全报头，远程攻击者利用该漏洞绕过身份验证。
CVSS Information
N/A
Vulnerability Type
N/A