Description (CNA)
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache CXF | affected 4.2.0 before 4.2.2; affected 4.0.0 before 4.1.7; affected 0 before 3.6.12 |
CWE
CWE-20
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.
A flaw was found in Apache CXF's JCA integration module. This Java Naming and Directory Interface (JNDI) Injection vulnerability allows for arbitrary code execution. A remote attacker could exploit this by manipulating the Java EE Connector Architecture (JCA) deployment descriptor (ra.xml) or runtime activation parameters, leading to the execution of malicious code on the affected system.