VULNERABILITY INTELLIGENCE
CVE-2017-5653
CVSS score5.3 MEDIUM
EPSS probability11.17%
CISA KEVNot currently listed
Published2017-04-18
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
Weakness classification
- CWE-295: Improper Certificate Validation
Primary references
- security@apache.org — Patch, Vendor Advisory
- security@apache.org — Third Party Advisory, VDB Entry
- security@apache.org — Third Party Advisory, VDB Entry
- security@apache.org — Issue Tracking
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- security@apache.org
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry