NVD

Id
13564  
Name
CVE-2010-2076  
Description
Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-08-19  
Modified Date
2010-08-25  
Seq
2010-2076  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
74907 13564 CVE-2010-2076 http://geronimo.apache.org/2010/07/21/apache-geronimo-v216-released.html  View
74908 13564 CVE-2010-2076 http://geronimo.apache.org/21x-security-report.html  View
74909 13564 CVE-2010-2076 http://geronimo.apache.org/22x-security-report.html  View
74910 13564 CVE-2010-2076 http://svn.apache.org/repos/asf/cxf/trunk/security/CVE-2010-2076.pdf  View
74911 13564 CVE-2010-2076 [cxf-users] 20100616 Important - Apache CXF security advisory CVE-2010-2076  View
74912 13564 CVE-2010-2076 42492  View
74913 13564 CVE-2010-2076 https://issues.apache.org/jira/browse/GERONIMO-5383  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
38326 JVNDB-2010-004111 Apache ServiceMix などで使用される Apache CXF における任意のファイルを読まれ任意の HTTP リクエストをサーバに送信される脆弱性 Apache ServiceMix、Apache Camel、Apache Chemistry、Apache jUDDI、Apache Geronimo などで使用される Apache CXF は、SOAP メッセージ内で DTD を拒否しないため、任意のファイルを読まれ任意の HTTP リクエストをサーバに送信される、またはサービス運用妨害 (CPU およびメモリ消費) 状態となる脆弱性が存在します。 CVE-2010-2076 44656 CVE-2010-2076 13564 7.5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-004111.html 2010-06-16 2012-06-26 View