CVE-2017-7662

published 2017-05-16

CVE-2017-7662: Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to…

high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	cxf_fediz	<= 1.3.2	—
apache	cxf_fediz	—	—
apache_software_foundation	apache_cxf_fediz	—	—

CWE-352