GHSA-g4px-6qhm-hqjm
Apache CXF: Untrusted JMS configuration can lead to RCE
At a glance
- Published
- Updated
- CVE
- CVE-2025-48913
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Description
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.cxf:cxf-rt-transports-jms | introduced 0, fixed 3.6.8 |
| Maven · org.apache.cxf:cxf-rt-transports-jms | introduced 4.0.0, fixed 4.0.9 |
| Maven · org.apache.cxf:cxf-rt-transports-jms | introduced 4.1.0, fixed 4.1.3 |
References
- https://github.com/mbhatt1/disclosures/security/advisories/GHSA-hv69-h8rg-7jg2 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-48913 ADVISORY
- https://github.com/apache/cxf/commit/24e50ffeca3132570c2f297c5c7dbd05a1bb1bfa WEB
- https://github.com/apache/cxf PACKAGE
- https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83 WEB
- http://www.openwall.com/lists/oss-security/2025/08/07/2 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |