CVE-2016-8739

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders

published August 10, 2017

CVSS
—
EPSS
7%
Percentile
94.3
In the wild
Unconfirmed
What it is

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07317 · 94.3th percentile
Published
2017-08-10T18:00Z
EPSS history
Timeline
  • 10 AUG 18:00Z
    The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders
    cvelistv5