CVE-2018-8039

CVE-2018-8039 describes a critical vulnerability in Apache CXF versions prior to 3.2.5 and 3.1.16, as well as Red Hat JBoss Enterprise Application Platform, where improper error handling during TLS hostname verification can lead to man-in-the-middle (MitM) attacks. Specifically, when configured to use the com.sun.net.ssl implementation, CXF fails to propagate exceptions related to hostname verification, effectively disabling this crucial security check. This vulnerability carries a CVSS v3.0 score of 8.1 (HIGH), indicating a severe risk. It is a network-based attack with high impact on confidentiality, integrity, and availability, though it has high attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The FAUCET Risk Score is 66/100, further emphasizing its significance. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or attention.