CVE-2016-6812
Status: ModifiedMedium (6.1)—💥 PoC
The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Base score: 6.1
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 7.55%
- Percentile among all scored CVEs: 94
- Score date: 10/12/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
💥 Public exploits
Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.
- Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub
⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.
Affected technologies (1)
CWEs
- CWE-79
References
- http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc
- http://www.securityfocus.com/bid/97582
- http://www.securitytracker.com/id/1037543
- https://access.redhat.com/errata/RHSA-2017:0868
- https://issues.apache.org/jira/browse/CXF-6216
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E
- http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc
- http://www.securityfocus.com/bid/97582
- http://www.securitytracker.com/id/1037543
- https://access.redhat.com/errata/RHSA-2017:0868
- https://issues.apache.org/jira/browse/CXF-6216
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E
Raw JSON (NVD)
Show
{
"id": "CVE-2016-6812",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@apache.org",
"affectedData": [
{
"vendor": "Apache Software Foundation",
"product": "Apache CXF",
"versions": [
{
"status": "affected",
"version": "prior to 3.0.12"
},
{
"status": "affected",
"version": "3.1.x prior to 3.1.9"
}
]
}
]
}
],
"published": "2017-08-10T16:29:00.657",
"references": [
{
"url": "http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "security@apache.org"
},
{
"url": "http://www.securityfocus.com/bid/97582",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@apache.org"
},
{
"url": "http://www.securitytracker.com/id/1037543",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@apache.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:0868",
"source": "security@apache.org"
},
{
"url": "https://issues.apache.org/jira/browse/CXF-6216",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E",
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E",
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E",
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E",
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E",
"source": "security@apache.org"
},
{
"url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E",
"source": "security@apache.org"
},
{
"url": "http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/97582",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1037543",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:0868",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://issues.apache.org/jira/browse/CXF-6216",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client."
},
{
"lang": "es",
"value": "El módulo de transporte HTTP en Apache CXF anterior a su versión 3.0.12 y en versiones 3.1.x anteriores a 3.1.9 utiliza FormattedServiceListWriter para proporcionar una página HTML que enumera los nombres y URL absolutas de endpoints de servicio disponibles. El módulo calcula la URL base empleando el HttpServletRequest actual. La URL base calculada es empleada por FormattedServiceListWritter para construir las URL absolutas de los endpoints de servicio. Si los parámetros matriz inesperados se han inyectado en la URL de petición, esos parámetros matriz volverán al cliente en la página de lista de servicios, lo que representa un riesgo de XSS para el cliente."
}
],
"lastModified": "2026-06-17T00:51:49.047",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98F580FB-30CB-424C-B401-02DD90BC2265",
"versionEndIncluding": "3.0.11"
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BFBBD3B0-C8AE-45BA-83A3-847F03E90319"
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52F66A01-83E5-48D8-AD1F-7F331CC889D3"
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A1BF056-AA31-4968-85C7-9897F5720325"
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF05B313-65F0-4DD3-B6AC-0B4F6E39E677"
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F0DA5338-6541-46CF-B8BC-BA41CF9C33CD"
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "132F95AB-FF48-4434-A5E7-4EC7C801FAC3"
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E74DDFC9-7DFB-4C60-B20D-274260481F1A"
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B0029085-6E5C-4502-967B-8CA47FDE39EF"
},
{
"criteria": "cpe:2.3:a:apache:cxf:3.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69F2C5BA-4052-46F7-9AF4-BB87E7A8FFFC"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@apache.org"
}