CyberRota Analysis
AI-GeneratedApache CXF's JMS transport is vulnerable due to its use of native Java deserialization for inbound JMS ObjectMessages without type restrictions, allowing attackers to send malicious serialized objects. This can lead to denial of service or, if certain classes are present, remote code execution. Organizations using affected versions of Apache CXF should prioritize upgrading to versions 4.2.3, 4.1.8, or 3.6.12 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)