title: Apache CXF directory listing / code exfiltration
description: A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: Apache CXF
vendor: Apache Software Foundation
versions:
lessThan: 3.5.5, status: affected, version: 3.5, versionType: maven
lessThan: 3.4.10, status: affected, version: 3.4, versionType: maven
}
metrics:
other: [
content: {'text': 'moderate'}
type: Textual description of severity
]