// For flags

CVE-2021-30468

Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.

Una vulnerabilidad en la función JsonMapObjectReaderWriter de Apache CXF permite a un atacante enviar un JSON malformado hacia un servicio web, lo que hace que el subproceso se quede atascado en un bucle infinito, consumiendo CPU indefinidamente. Este problema afecta a Apache CXF versiones anteriores a 3.4.4 y Apache CXF versiones anteriores a 3.3.11

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-04-08 CVE Reserved
  • 2021-06-16 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-11-03 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CAPEC
References (17)
URL Tag Source
http://www.openwall.com/lists/oss-security/2021/06/16/2 Mailing List
https://lists.apache.org/thread.html/r3f46ae38e4a6e80c069cdb320e0ce831b0a21a12ef0cc92c0943f34a%40%3Ccommits.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r4771084730c4cf6e59eda60b4407122c86f174eb750b24f610ba9ff4%40%3Ccommits.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cannounce.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cdev.cxf.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cusers.cxf.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r54c0f1cbbb9f381dfbedb9ea5e90ecb1c0a15371f40c4b10322ac737%40%3Ccommits.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/ra833f78b3fa577cb43558cf343859a1bf70b1c5ce2353b3877d96422%40%3Ccommits.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rac07822057521dccf33ab5d136e0e8c599a6e2c8ac75e44ffbdc6e07%40%3Ccommits.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/re5b2a2b77faa22684d47bd2ac6623135c615565328ff40a1ec705448%40%3Ccommits.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/re9e05c6cab5f0dcc827eba4e6fcf26fa0b493e7ca84d62c867a80d03%40%3Ccommits.tomee.apache.org%3E Mailing List
https://security.netapp.com/advisory/ntap-20210917-0002 Third Party Advisory
URL Date SRC
URL Date SRC
https://www.oracle.com/security-alerts/cpuapr2022.html 2023-11-07
https://www.oracle.com/security-alerts/cpuoct2021.html 2023-11-07
URL Date SRC
http://cxf.apache.org/security-advisories.data/CVE-2021-30468.txt.asc 2023-11-07
https://access.redhat.com/security/cve/CVE-2021-30468 2022-11-02
https://bugzilla.redhat.com/show_bug.cgi?id=1973392 2022-11-02
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Cxf
Search vendor "Apache" for product "Cxf"
 < 3.3.11
Search vendor "Apache" for product "Cxf" and version " < 3.3.11"
-
Affected
Apache
Search vendor "Apache"
 Cxf
Search vendor "Apache" for product "Cxf"
 >= 3.4.0 < 3.4.4
Search vendor "Apache" for product "Cxf" and version " >= 3.4.0 < 3.4.4"
-
Affected
Apache
Search vendor "Apache"
 Tomee
Search vendor "Apache" for product "Tomee"
 8.0.6
Search vendor "Apache" for product "Tomee" and version "8.0.6"
-
Affected
Oracle
Search vendor "Oracle"
 Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
 5.5.0.0.0
Search vendor "Oracle" for product "Business Intelligence" and version "5.5.0.0.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
 Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
 5.9.0.0.0
Search vendor "Oracle" for product "Business Intelligence" and version "5.9.0.0.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
 Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
 12.2.1.3.0
Search vendor "Oracle" for product "Business Intelligence" and version "12.2.1.3.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
 Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
 12.2.1.4.0
Search vendor "Oracle" for product "Business Intelligence" and version "12.2.1.4.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
 Communications Element Manager
Search vendor "Oracle" for product "Communications Element Manager"
 8.2.2
Search vendor "Oracle" for product "Communications Element Manager" and version "8.2.2"
-
Affected
Oracle
Search vendor "Oracle"
 Communications Messaging Server
Search vendor "Oracle" for product "Communications Messaging Server"
 8.1
Search vendor "Oracle" for product "Communications Messaging Server" and version "8.1"
-
Affected