Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
https://exchange.xforce.ibmcloud.com/vulnerabilities/78734
https://bugzilla.redhat.com/show_bug.cgi?id=851896
http://svn.apache.org/viewvc?view=revision&revision=1368559
http://secunia.com/advisories/52183
http://secunia.com/advisories/51607
http://rhn.redhat.com/errata/RHSA-2013-0743.html
http://rhn.redhat.com/errata/RHSA-2013-0726.html
http://rhn.redhat.com/errata/RHSA-2013-0259.html
http://rhn.redhat.com/errata/RHSA-2013-0258.html
http://rhn.redhat.com/errata/RHSA-2013-0257.html
http://rhn.redhat.com/errata/RHSA-2013-0256.html
http://rhn.redhat.com/errata/RHSA-2012-1594.html
http://rhn.redhat.com/errata/RHSA-2012-1592.html