Code Injection in Apache CXF - CVE-2025-48913

Vulnerability identifier: #VU117342

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-48913

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when handling JMS configuration. A remote user can pass specially crafted configuration file to the application and execute arbitrary code on the target system.

Apache CXF
Communications Unified Assurance
JBoss Enterprise Application Platform
Maximo Application Suite - IoT Component
Guardium Data Protection
SAP Data Hub Integration Suite
eap8-wss4j (Red Hat package)
eap8-xml-security (Red Hat package)
eap8-apache-commons-lang (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap8-apache-cxf-xjc-utils (Red Hat package)
eap8-netty-transport-native-epoll (Red Hat package)
eap8-netty (Red Hat package)
eap8-opensaml (Red Hat package)
eap8-jbossws-cxf (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)

Install updates from vendor's website.

Apache CXF - addressed in versions 3.6.8, 4.0.9, 4.1.3
JBoss Enterprise Application Platform - addressed in versions 8.0.9, 8.1.0
Maximo Application Suite - IoT Component - addressed in versions 8.7.27, 8.8.23, 9.0.13, 9.1.4
eap8-wss4j (Red Hat package) - addressed in versions 3.0.4-1.redhat_00002.1.el8eap, 3.0.4-1.redhat_00002.1.el9eap
eap8-xml-security (Red Hat package) - addressed in versions 3.0.5-1.redhat_00001.1.el8eap, 3.0.5-1.redhat_00001.1.el9eap
eap8-apache-commons-lang (Red Hat package) - addressed in versions 3.18.0-1.redhat_00002.1.el8eap, 3.18.0-1.redhat_00002.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.9-4.redhat_00002.1.el8eap, 4.0.9-4.redhat_00002.1.el9eap, 4.0.9-5.redhat_00002.1.el8eap, 4.0.9-5.redhat_00002.1.el9eap
eap8-apache-cxf-xjc-utils (Red Hat package) - addressed in versions 4.1.0-1.redhat_00001.1.el8eap, 4.1.0-1.redhat_00001.1.el9eap
eap8-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.127-1.Final_redhat_00001.1.el8eap, 4.1.127-1.Final_redhat_00001.1.el9eap
eap8-netty (Red Hat package) - addressed in versions 4.1.127-1.Final_redhat_00001.1.el8eap, 4.1.127-1.Final_redhat_00001.1.el9eap
eap8-opensaml (Red Hat package) - addressed in versions 4.3.2-2.redhat_00002.1.el8eap, 4.3.2-2.redhat_00002.1.el9eap
eap8-jbossws-cxf (Red Hat package) - addressed in versions 7.3.4-1.Final_redhat_00001.1.el8eap, 7.3.4-1.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.9-8.GA_redhat_00008.1.el8eap, 8.0.9-8.GA_redhat_00008.1.el9eap, 8.1.0-55.GA_redhat_00016.1.el8eap, 8.1.0-55.GA_redhat_00016.1.el9eap
Guardium Data Protection - update to 11.0p575
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.9.1-3.GA_redhat_00004.1.el8eap, 800.9.1-3.GA_redhat_00004.1.el9eap, 801.0.1-2.GA_redhat_00003.1.el8eap, 801.0.1-2.GA_redhat_00003.1.el9eap

• https://lists.apache.org/thread/zv3pb5cxt5qpmbo1b8cp91r2joxx179o

• Remote code execution in Apache CXF
• SAP Data Hub Integration Suite update for Apache CXF
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• IBM Guardium Data Protection update for Apache CXF
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in Communications Unified Assurance