CVE-2012-3451

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-09-24 · updated 2026-06-16
Weakness: CWE-20

Description

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.

Affected products

Apache Software Foundation Apache CXF: before 2.4.9; from 2.5.0 before 2.5.5; from 2.6.0 before 2.6.2 — fixed in 2.4.9, 2.5.5, 2.6.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CXF 2.4.9, 2.5.5, 2.6.2. Check the vendor advisory for mitigations.

References

http://cxf.apache.org/cve-2012-3451.html
http://rhn.redhat.com/errata/RHSA-2012-1591.html
http://rhn.redhat.com/errata/RHSA-2012-1592.html
http://rhn.redhat.com/errata/RHSA-2012-1594.html
http://rhn.redhat.com/errata/RHSA-2013-0256.html
http://rhn.redhat.com/errata/RHSA-2013-0257.html
http://rhn.redhat.com/errata/RHSA-2013-0258.html
http://rhn.redhat.com/errata/RHSA-2013-0259.html
http://rhn.redhat.com/errata/RHSA-2013-0726.html
http://rhn.redhat.com/errata/RHSA-2013-0743.html
http://secunia.com/advisories/51607
http://secunia.com/advisories/52183

Get alerted when CVE-2012-3451 or the next vulnerability affects your stack