CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows…

published April 18, 2017

CVSS
—
EPSS
11%
Percentile
95.9
In the wild
Unconfirmed
What it is

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.11167 · 95.9th percentile
Published
2017-04-18T16:00Z
EPSS history
Timeline
  • 18 APR 16:00Z
    JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows…
    cvelistv5