CVE-2015-5175:
Apache CXF Fediz application plugins are vulnerable to Denial of Service (DoS) attacks
7.5
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.93887%
CWE
Published
10/18/2018
Updated
9/27/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.cxf.fediz:fediz-idp | maven | < 1.1.3 | 1.1.3 |
| org.apache.cxf.fediz:fediz-idp | maven | >= 1.2, < 1.2.1 | 1.2.1 |
| org.apache.cxf.fediz:fediz-core | maven | < 1.1.3 | 1.1.3 |
| org.apache.cxf.fediz:fediz-core | maven | >= 1.2, < 1.2.1 | 1.2.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from insecure XML parsing configurations. The commit diff shows the introduction of FEATURE_SECURE_PROCESSING and removal of vulnerable DocumentBuilderFactory usage. The unpatched versions of DOMUtils.readXml and SignatureUtils.signMetaInfo lacked these protections, making them susceptible to DoS via malicious DTDs or entity expansion attacks. These functions directly process external input (XML responses) without proper validation, aligning with CWE-20.