imPC@ndo IT

Tracker / CVE-2017-5656

CVE-2017-5656

High 7.5

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

Affected products and versions

apache cxf · 3.0.0 → 3.0.13
apache cxf · 3.1.0 → 3.1.11

Analysis

This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.

References