Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Apache
Information Disclosure
Cxf
NVD
CVSS 2.0
4.3
EPSS
10.0%