A vulnerability was found in Apache CXF up to 3.0.12/3.1.10 (Application Server Software). It has been rated as problematic. This issue affects an unknown part of the component STSClient. The manipulation with an unknown input leads to a session fixiation vulnerability. Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is confidentiality. The summary by CVE is:

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

The bug was discovered 04/18/2017. The weakness was published 04/18/2017 (Website). It is possible to read the advisory at cxf.apache.org. The identification of this vulnerability is CVE-2017-5656 since 01/29/2017. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.0.13 or 3.1.11 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 97971†). Similar entry is available at VDB-99934. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• CXF

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.1.8
• 3.1.9
• 3.1.10

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion