XML Entity Expansion Vulnerability in Apache CXF JAX-RS Module

CVE-2016-8739

What is CVE-2016-8739?

The JAX-RS module in Apache CXF versions prior to 3.0.12 and 3.1.x prior to 3.1.9 is vulnerable to XML External Entity (XXE) injection. This vulnerability arises due to the presence of MessageBodyReaders that utilize the Apache Abdera Parser, which by default expands XML entities. This expansion can allow an attacker to exploit the system by manipulating XML input, potentially disclosing sensitive information or causing unintended operations. Organizations using affected versions of Apache CXF should take immediate action to upgrade to secure releases to mitigate the risk.

References