Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given
    message. This leaves open the possibility of a denial of service type attack, where a malicious user
    crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11
    releases, a default limit of 50 message attachments is enforced. This is configurable via the message
    property "attachment-max-count". (CVE-2019-12406)

The IBM WebSphere Application Server running on the remote host is version 9.0.x prior to 9.0.5.3. It is, therefore, affected by a denial of service (DoS) vulnerability in the Apache CXF library used by the WebSphere Application Server, which does not restrict the number of message attachments present in a given message. An unauthenticated, remote attacker can exploit this, by crafting a message containing a very large number of message attachments, in order to cause a denial of service condition.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
423312	SCA: security update for org.apache.cxf:apache-cxf, org.apache.cxf:cxf (GHSA-58p8-9g59-q2hr)	Tenable Cloud Security	SCA Checks	medium
423312	SCA: security update for org.apache.cxf:apache-cxf, org.apache.cxf:cxf (GHSA-58p8-9g59-q2hr)	Tenable Self-Hosted Container Security	SCA Checks	medium
141562	IBM WebSphere Application Server 9.0.x < 9.0.5.3 DoS (CVE-2019-12406)	Nessus	Web Servers	medium

Detections

Analytics

CVE-2019-12406

medium

Tenable Plugins

medium

medium

medium