GitHub Advisoryadvisory · Maven

GHSA-v936-x3j5-c76j Session Fixation in Apache CXF

HIGH Published 2022-05-13 Modified 2023-12-21 Official page ↗
Aliases
CVE-2017-5656
Ecosystem
Maven
Packages
org.apache.cxf:cxf-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-384
Reviewed
2022-07-01

Affected packages

• Maven org.apache.cxf:cxf-core: >= 3.1.0, < 3.1.11 → fixed in 3.1.11 • Maven org.apache.cxf:cxf-core: < 3.0.13 → fixed in 3.0.13

Description

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

Related

Alias · CVE (1)

  • CVE-2017-5656 Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means… vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References