CVE-2020-1954
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-1954
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache CXF 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache CXF是美国阿帕奇（Apache）软件基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。 Apache CXF 3.2.13之前版本和3.3.6之前版本中存在信息泄露漏洞。攻击者可利用该漏洞获取敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache | Apache CXF | affects all versions prior to 3.3.6 and 3.2.13 | - |
II. Public POCs for CVE-2020-1954
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-1954
请登录查看更多情报信息。
- https://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2020-1954
Same Patch Batch · Apache · 2020-04-01 · 7 CVEs total
| CVE-2018-11802 | Apache Solr 安全漏洞 | |
| CVE-2019-17564 | Apache Dubbo 安全漏洞 | |
| CVE-2020-1927 | Apache HTTP Server 输入验证错误漏洞 | |
| CVE-2020-1934 | Apache HTTP Server 安全漏洞 | |
| CVE-2020-1943 | Apache OFBiz 跨站脚本漏洞 | |
| CVE-2020-1958 | Apache Druid 注入漏洞 |
IV. Related Vulnerabilities
Same product: Apache CXF
- CVE-2025-48913
Apache CXF: Untrusted JMS configuration can lead to RCE - CVE-2025-48795
Apache CXF: Denial of Service and sensitive data exposure in - CVE-2025-23184
Apache CXF: Denial of Service vulnerability with temporary f - CVE-2024-41172
Apache CXF: Unrestricted memory consumption in CXF HTTP clie - CVE-2024-32007
Apache CXF Denial of Service vulnerability in JOSE
Same vendor: Apache
- CVE-2025-58712
Amq: privilege escalation via excessive /etc/passwd permissi - CVE-2024-42362
GHSL-2023-255: HertzBeat Authenticated (user role) RCE via u - CVE-2024-42361
GHSL-2023-256: HertzBeat Authenticated (guest role) SQL inje - CVE-2021-32824
Regular expression Denial of Service in MooTools - CVE-2021-25958
Generation of Error Message Containing Sensitive Information
V. Comments for CVE-2020-1954
No comments yet