Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
Threat-Mapped Scoring
Score: 1.5
Priority: P4 - Informational (Low)
S10 – Denial of Service
EPSS
Score: 0.07827 Percentile:
0.91557
CVSS Scoring
CVSS v3.1 Score: 9.8
Severity: CRITICAL
Mapped CWE(s)
CWE-829
: Inclusion of Functionality from Untrusted Control Sphere
All CAPEC(s)
CAPEC-175: Code Inclusion
CAPEC-201: Serialized Data External Linking
CAPEC-228: DTD Injection
CAPEC-251: Local Code Inclusion
CAPEC-252: PHP Local File Inclusion
CAPEC-253: Remote Code Inclusion
CAPEC-263: Force Use of Corrupted Files
CAPEC-538: Open-Source Library Manipulation
CAPEC-549: Local Execution of Code
CAPEC-640: Inclusion of Code in Existing Process
CAPEC-660: Root/Jailbreak Detection Evasion via Hooking