CVE-2012-0803

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Aug 8, 2017
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2012

CVE-2012-080410.0Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a deCVE-2012-08057.5Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL coCVE-2012-08066.5Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of CVE-2012-08075.1Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extensCVE-2012-08083.6as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local usersCVE-2012-08097.2Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via formatCVE-2012-08105.5The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stacCVE-2012-08116.5Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrarCVE-2012-08126.1PostfixAdmin 2.3.4 has multiple XSS vulnerabilitiesCVE-2012-08132.1Wicd before 1.7.1 saves sensitive information in log files in /var/log/wicd, which allows context-dependent attackers to obtain passwords anCVE-2012-08146.5The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command oCVE-2012-08156.8The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibl
CVE-2012-0803: Critical severity, CVSS 9.8 | Vulnix