GHSA-g4px-6qhm-hqjm

Apache CXF: Untrusted JMS configuration can lead to RCE

En bref

Publiée: 2025-08-08 12:32 UTC
Mise à jour: 2026-09-10 03:50 UTC
CVE: CVE-2025-48913
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Description

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.

Paquets affectés

Paquet	Versions
Maven · org.apache.cxf:cxf-rt-transports-jms	introduced 0, fixed 3.6.8
Maven · org.apache.cxf:cxf-rt-transports-jms	introduced 4.0.0, fixed 4.0.9
Maven · org.apache.cxf:cxf-rt-transports-jms	introduced 4.1.0, fixed 4.1.3

Références

https://github.com/mbhatt1/disclosures/security/advisories/GHSA-hv69-h8rg-7jg2 WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-48913 ADVISORY
https://github.com/apache/cxf/commit/24e50ffeca3132570c2f297c5c7dbd05a1bb1bfa WEB
https://github.com/apache/cxf PACKAGE
https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83 WEB
http://www.openwall.com/lists/oss-security/2025/08/07/2 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database