Read the docs
TI-2016-05853 Aliases CVE-2016-6812GHSA-vw2c-5wph-v92r

Cross-site scripting in Apache CXF

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 2 fixed, 9 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.

Why it matters now

EPSS 0.07547 94th percentileScored 2026-11-07
Fix Partial Apache CXF (Apache Software Foundation): 3.0.12, 3.1.9org.apache.cxf:cxf-core (Maven): 3.0.12, 3.1.9Red Hat: 1 advisoryRed Hat: 2 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache CXFbefore 3.0.12; 3.1 to before 3.1.93.0.12, 3.1.9Patch availableCNA
—org.apache.cxf:cxf-core (Maven)before 3.0.123.0.12Patch availableGHSA-vw2c-5wph-v92r
—org.apache.cxf:cxf-core (Maven)3.1.0 to before 3.1.93.1.9Patch availableGHSA-vw2c-5wph-v92r
  • Apache CXF VendorApache Affected before 3.0.12; 3.1 to before 3.1.9 Fixed in 3.0.12, 3.1.9 Patch available CNA
  • org.apache.cxf:cxf-core (Maven) Vendor— Affected before 3.0.12 Fixed in 3.0.12 Patch available GHSA-vw2c-5wph-v92r
  • org.apache.cxf:cxf-core (Maven) Vendor— Affected 3.1.0 to before 3.1.9 Fixed in 3.1.9 Patch available GHSA-vw2c-5wph-v92r

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*up to 3.0.11VulnerableApache
cpe:2.3:a:apache:cxf:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableApache
cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableApache
cpe:2.3:a:apache:cxf:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableApache
cpe:2.3:a:apache:cxf:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableApache
cpe:2.3:a:apache:cxf:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableApache
cpe:2.3:a:apache:cxf:3.1.5:*:*:*:*:*:*:*3.1.5VulnerableApache
cpe:2.3:a:apache:cxf:3.1.6:*:*:*:*:*:*:*3.1.6VulnerableApache
cpe:2.3:a:apache:cxf:3.1.7:*:*:*:*:*:*:*3.1.7VulnerableApache
cpe:2.3:a:apache:cxf:3.1.8:*:*:*:*:*:*:*3.1.8VulnerableApache
  • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* Versions up to 3.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:3.1.5:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:3.1.6:*:*:*:*:*:*:* Versions 3.1.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:3.1.7:*:*:*:*:*:*:* Versions 3.1.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:3.1.8:*:*:*:*:*:*:* Versions 3.1.8 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache CXF (Apache Software Foundation) Fixed in 3.0.12, 3.1.9
  • Fix · GHSA-vw2c-5wph-v92r org.apache.cxf:cxf-core (Maven) Fixed in 3.0.12 Advisory →
  • Fix · GHSA-vw2c-5wph-v92r org.apache.cxf:cxf-core (Maven) Fixed in 3.1.9 Advisory →

Red Hat 1 advisory

  • RHSA-2017:0868 Released 2017-04-03 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix yet
Red Hat JBoss BRMS 5AffectedNo fix planned: Will not fix
Red Hat JBoss BRMS 6AffectedNo fix yet
Red Hat JBoss Data Grid 6AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix yet
Red Hat JBoss Portal 6AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 2Affected—
Red Hat JBoss A-MQ 6.3Fixed RHSA-2017:0868
Red Hat JBoss Fuse 6.3Fixed RHSA-2017:0868
Not affected: 6 products
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Operations Network 3
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6812
  2. 2026-10-03 Alias added: GHSA-vw2c-5wph-v92r

References

Patch 1

Advisory 3

Other 17

  • TI-2019-09264 Incorrect authorization in Apache CXF CVSS 3.1CRITICAL 9.8
  • TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
  • TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
  • TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences