CVE-2017-5656
18.04.2017, 16:59
Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apache | cxf | 3.0.0 ≤ 𝑥 < 3.0.13 |
| apache | cxf | 3.1.0 ≤ 𝑥 < 3.1.11 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References