If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility.
Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Aug 2025, 19:46
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* | |
| CWE | NVD-CWE-noinfo | |
| References | () https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83 - Mailing List, Third Party Advisory | |
| First Time |
Apache
Apache cxf |
08 Aug 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
08 Aug 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-08 10:15
Updated : 2025-08-14 19:46
NVD link : CVE-2025-48913
Mitre link : CVE-2025-48913
JSON object : View
Products Affected
apache
- cxf
CWE