description: JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
problem types: XML Security streaming clients do not validate that the service response was secured.
affected:
{
product: Apache CXF
vendor: Apache Software Foundation
versions:
status: affected, version: prior to 3.0.13
status: affected, version: 3.1.x prior to 3.1.11
}