CVE-2018-8038 in the critical feed json
High severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3
published 2018-07-05 8 y ago modified 2026-06-17 4 mo ago also GHSA-w3gh-g32m-cvhr , EUVD-2018-0704
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 10.6%
- EPSS 10.6% chance of exploitation in 30 days, percentile 95%
- public exploits
- 0
- none known
Summary
Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.
Patch / fix
- maven org.apache.cxf.fediz:fediz-spring 1.4.4
- maven org.apache.cxf.fediz:fediz-spring2 1.4.4
- maven org.apache.cxf.fediz:fediz-spring3 1.4.4
- maven org.apache.cxf.fediz:fediz-jetty8 1.4.4
- maven org.apache.cxf.fediz:fediz-jetty9 1.4.4
- apache cxf_fediz 1.4.4
Exploit prediction
10.60% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.cxf.fediz:fediz-spring | <1.4.4 |
1.4.4 |
| maven | org.apache.cxf.fediz:fediz-spring2 | <1.4.4 |
1.4.4 |
| maven | org.apache.cxf.fediz:fediz-spring3 | <1.4.4 |
1.4.4 |
| maven | org.apache.cxf.fediz:fediz-jetty8 | <1.4.4 |
1.4.4 |
| maven | org.apache.cxf.fediz:fediz-jetty9 | <1.4.4 |
1.4.4 |
Affected products
- Apache Software Foundation Apache CXF Fediz
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/apache/cxf-fediz/commit/b6ed9865d0614332fa419fe4b6d0fe81bc2e660d
web, patch, third-party-advisory
-
cxf.apache.org
/security-advisories.data/CVE-2018-8038.txt.asc
web, vendor-advisory
-
lists.apache.org
/thread.html/f0a6a05ec3b3a00458da43712b0ff3a2f573175d9bfb39fb0de21424%40%3Cdev.cxf.apache.org%3E
mailing-list
-
securitytracker.com
/id/1041220
vdb-entry, web, third-party-advisory
-
lists.apache.org
/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
mailing-list
-
lists.apache.org
/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2018-8038
advisory
-
github.com
/advisories/GHSA-w3gh-g32m-cvhr
advisory
-
lists.apache.org
/thread.html/f0a6a05ec3b3a00458da43712b0ff3a2f573175d9bfb39fb0de21424@%3Cdev.cxf.apache.org%3E
web
-
lists.apache.org
/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
web
-
lists.apache.org
/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
web
-
lists.apache.org
/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
web
-
lists.apache.org
/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
web
-
lists.apache.org
/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
web
-
lists.apache.org
/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
web
Sources
- CVE List CVE-2018-8038
- GitHub Advisory GHSA-w3gh-g32m-cvhr
- NVD CVE-2018-8038
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.