Apache CXF WS-Transfer Module Insecure XML Parser Configuration Leading to XXE Vulnerability

A vulnerability exists in the WS-Transfer module of Apache CXF due to an insecure XML parser configuration, which may allow attackers to conduct XML External Entity (XXE) attacks. This issue affects Apache CXF versions 4.2.0 prior to 4.2.1, 4.0.0 prior to 4.1.6, and versions prior to 3.6.11.

Impact

Exploitation of this vulnerability could lead to XXE attacks, allowing attackers to interfere with the application’s processing of XML, potentially accessing internal files or services.

Remediation

Users are advised to upgrade to Apache CXF versions 4.2.1, 4.1.6, or 3.6.11, all of which address this vulnerability.