Description
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
Exploits (1)
github
WORKING POC
1 stars
by exploitintel · pythonpoc
https://github.com/exploitintel/eip-pocs-and-cves/tree/main/CVE-2025-48913
Scores
CVSS v3
9.8
EPSS
0.0016
EPSS Percentile
36.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lab Environment
attacker
patched
vulnerable
docker pull ghcr.io/exploitintel/cve-2025-48913-vulnerable:latest
Classification
CWE
CWE-20
Status
published
Affected Products (2)
apache/cxf
< 3.6.8
org.apache.cxf/cxf-rt-transports-jms
< 3.6.8Maven
Timeline
Published
Aug 08, 2025
Tracked Since
Feb 18, 2026