-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from CXFServlet's request handling logic when both static-resources-list and redirect-query-check are enabled. The handleRequest() method is central to processing HTTP requests and would be responsible for applying these configurations. The combination of these attributes likely bypasses security checks (CWE-20) that normally prevent unauthorized resource access, leading to information exposure (CWE-200). While exact code isn't provided, the CXFServlet's request handling is the logical point where misconfiguration would manifest, aligning with the vulnerability description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.cxf:cxf-core | maven | < 3.4.10 | 3.4.10 |
| org.apache.cxf:cxf-core | maven | >= 3.5.0, < 3.5.5 | 3.5.5 |
JavaJava