CVE-2012-5633: The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when usin...

Security readout for executives and security teams

A flaw in Apache CXF let some SOAP services protected by WS-Security be reached without that security check. If an affected application used WSS4JInInterceptor, an attacker could access SOAP services with an HTTP GET. The issue affects CXF before 2.5.8, 2.6.5, and 2.7.2. Exposure is likely in legacy Java SOAP services using Apache CXF with WSS4JInInterceptor on the affected versions. Downstream products that embedded vulnerable CXF builds may also be affected, as reflected by Red Hat and JBoss references. Prioritize remediation for internet-facing or partner-facing SOAP services, especially where WS-Security protects sensitive business operations. The risk is unauthorized service access, but available sources do not prove active exploitation. Mitigation focus: Upgrade Apache CXF to 2.5.8, 2.6.5, 2.7.2, or later as applicable.; Check Red Hat, JBoss, or other vendor advisories for packaged CXF updates.; Inventory SOAP services using WSS4JInInterceptor and exposed HTTP GET handling..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.