PT-2017-17868 · Apache · Apache Cxf Fediz

Published 2017-05-16 · Updated 2022-05-13 · CVE-2017-7662

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF Fediz versions prior to 1.4.0 Apache CXF Fediz versions prior to 1.3.2

Description A Cross-Site Request Forgery (CSRF) style issue has been found in the OpenId Connect (OIDC) service's Client Registration Service of Apache CXF Fediz. This allows a malicious web application to create new clients or reset secrets after an admin user has logged on to the client registration service and the session is still active.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later. For versions prior to 1.3.2, update to version 1.3.2 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-7662

GHSA-F5CH-36RG-VFCC

Affected Products

Apache Cxf Fediz

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2017-7662 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7662 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f5ch-36rg-vfcc · Vendor Advisory
• http://cxf.apache.org/security-advisories.data/CVE-2017-7662.txt.asc · Vendor Advisory
• https://github.com/apache/cxf-fediz/commit/c68e4820816c19241568f4a8fe8600bffb0243cd · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E · Note