Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without applying necessary JAXP hardening configurations, resulting in an XML External Entity (XXE) vulnerability (CWE-611). This allows out-of-band external entity resolution, which can be exploited by remote attackers to disclose sensitive information from the affected system. The vulnerability affects multiple Apache CXF versions prior to 4.1.7 and 4.2.2. Red Hat advisories confirm the issue affects their products that bundle Apache CXF, such as Enterprise Application Platform and JBoss Web Server. No mitigation or fix currently meets Red Hat's criteria for ease of deployment and applicability, though Apache CXF upstream versions 4.2.2, 4.1.7, and 3.6.12 include fixes.

The vulnerability allows remote attackers to disclose sensitive information by exploiting improper XML parsing configurations that enable out-of-band external entity resolution. This can lead to reading arbitrary files on the system or causing the application to make unintended network requests. The impact is confidentiality loss without integrity or availability impact. Red Hat products bundling Apache CXF are affected, but no fix or mitigation currently meets their criteria. The CVSS 3.1 base score is 6.5 (medium severity) reflecting high confidentiality impact with low attack complexity and no user interaction required.

Upgrading Apache CXF to versions 4.2.2, 4.1.7, or 3.6.12 is recommended to address this vulnerability. For Red Hat products bundling Apache CXF, no mitigation or fix currently meets Red Hat's criteria for deployment and stability. Users should monitor Red Hat advisories for updates and consider upgrading to fixed versions when available. No vendor-provided temporary fixes or workarounds are currently documented.