Cross site request forgery (csrf)

Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...

CVE-2017-7662

Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...

CVE-2017-7661

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4...

CVE-2017-7662

Apache CXF Fediz’s OpenID Connect Client Registration Service is vulnerable to CSRF in versions prior to 1.4.0 and 1.3.2. A malicious web app could create new clients or reset secrets after an admin logs in and the session remains active. The connected sources corroborate the same description acr...

CVE-2017-7661

CVE-2017-7661 affects Apache CXF Fediz container-specific WS-Federation plugins (Spring 2, Spring 3, Jetty 8, Jetty 9) in CXF Fediz prior to versions 1.4.0, 1.3.2, and 1.2.4. The issue is described as a CSRF‑style vulnerability. The connected documents confirm the affected plugins and versions bu...

CVE-2017-5656

It was found that the token cacher in Apache cxf uses a flawed way of caching tokens that are associated with the delegation token received from Security Token Service STS. This vulnerability could allow an attacker to craft a token which could return an identifier corresponding to a cached token...

Apache CXF Cross-Site Scripting Vulnerability

Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. A cross-site scripting vulnerability exists in Apache CXF versions prior to 3.0.12 and...

Apache CXF Information Disclosure Vulnerability

Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. Apache CXF versions before 3.1.11 and 3.0.13 before the STSClient has a security...

Information Disclosure

Apache cxf-rt-ws-security is vulnerable to information disclosure. A malicious user can pass a malicious delegation token to the application, causing the application to return a cached token from another user...

Design/Logic Flaw

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user...

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

Code injection

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

CVE-2017-5656

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user...

CVE-2017-5656

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user...

CVE-2017-5653

CVE-2017-5653 affects Apache CXF JAX-RS XML Security streaming clients. The root cause is that these clients do not validate that the service response was signed or encrypted, enabling remote attackers to spoof servers. Affected: CXF versions prior to 3.1.11 and 3.0.13. Impact (per public records...

CVE-2017-5656

CVE-2017-5656 : Apache CXF’s STSClient (before 3.1.11 and 3.0.13) caches delegation-related tokens in a flawed way, enabling an attacker to craft a token that resolves to a cached token identifier belonging to another user. This can bypass security restrictions. The provided documents confirm the...

CVE-2017-5656

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Apache CXF Timing Attack Information Disclosure Vulnerability

Apache CXF is the United States Apache Apache Software Foundation, an open source Web services framework. A timing attack vulnerability exists in the Apache CXF OAuth2 Hawk and JOSE MAC authentication code, which allows remote attackers to submit a special request to obtain sensitive information...

Timing Attacks

Apache CXF is susceptible to timing attacks. The vulnerability is possible because MAC signature comparison algorithm used by its OAuth2 Hawk and JOSE MAC Validation code is not performed in constant time. Therefore, an attacker can trigger a timing attack through the OAuth2 Hawk or JWT access...