PT-2017-12612 · Spring+1 · Spring+1

Publicado 2017-11-30 · Atualizado 2021-06-16 · CVE-2017-12631

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF Fediz versions prior to 1.4.3 Apache CXF Fediz versions prior to 1.3.3

Description A CSRF style vulnerability has been found in the Spring 2, Spring 3, and Spring 4 plugins. This issue can result in a security context that is set up using a malicious client's roles for the given end-user.

Recommendations For versions prior to 1.4.3, update to version 1.4.3 or later. For versions prior to 1.3.3, update to version 1.3.3 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-12631

GHSA-FV7X-4HPC-HF9F

Produtos afetados

Apache Cxf Fediz

Spring

Referências · 24

• https://github.com/apache/cxf-fediz · Nota
• https://github.com/apache/cxf-fediz/commit/48dd9b68d67c6b729376c1ce8886f52a57df6c45 · Nota
• https://github.com/apache/cxf-fediz/commit/ccdb12b26ff89e0a998a333e84dd84bd713ac76c · Nota
• http://securityfocus.com/bid/102127 · Nota
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-fv7x-4hpc-hf9f · Aviso do Fabricante
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Nota
• http://securitytracker.com/id/1040487 · Nota
• https://web.archive.org/web/20180122175008/http://cxf.547215.n5.nabble.com/Apache-CXF-Fediz-1-4-3-and-1-3-3-released-with-a-new-security-advisory-CVE-2017-12631-td5785868.html · Nota
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E · Nota
• http://cxf.547215.n5.nabble.com/Apache-CXF-Fediz-1-4-3-and-1-3-3-released-with-a-new-security-advisory-CVE-2017-12631-td5785868.html · Nota
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Nota
• https://web.archive.org/web/20201208184733/http://securitytracker.com/id/1040487 · Nota
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E · Nota